Hypothesis Generation Model for Cyber Threat Hunting
Cheol-Gyu Yi, Young‐Gab Kim · IEEE Communications Magazine · 2024
Cyber attackers are rapidly developing their attack tactics and techniques, and their threats already pose a great danger to the world. Using cyber threat intelligence, security analysts make attack reconstruction possible, and human analysts are mainly responsible for the analysis of security system alerts. A cyber threat hunting hypothesis typically addresses the type of threat being hunted and how it is discovered. In this study, we propose a five-step hypothesis generation model for cyber threat hunting. The proposed model leverages proactive indicators of attack (IOAs) and information technology (IT) asset information related to network security, and correlates them with indicators of compromise (IOCs), defines the structure of hypothesis, and presents the attack domains-based hypothesis generation method for the formation of complicated hypotheses. In addition, it provides an approach to prioritizing the hypotheses.