On correlating network traffic for cyber threat intelligence: A Bloom filter approach

摘要: Internet and organizational network security is still threatened by devastating malicious activities. Given the continuous escalation of such attacks in terms their frequency, sophistication stealthiness, it paramount importance to generate effective cyber threat intelligence that aims at inferring, attributing, characterizing mitigating misdemeanors. Nevertheless, imperative tasks are partially impeded lack correlation approaches can produce prompt accurate actionable investigating various traffic sources. To this end, paper proposes a simple yet approach generically correlate for purposes. The uniquely exploits Bloom filters infer similarities between analyzed while eliminating false negatives managing very low measurable positive rate. We demonstrate effectiveness proposed empirically evaluating using 10 GB real darknet data close 15 thousand malware samples. outcome rendered hundreds inferred attributed Internet-scale infections, which we corroborate third-party publicly accessible repositories. envision could be leveraged as an component complex information event management systems provide metrics would aid comprehending activities incidents.