Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains

By E. Hutchins, Michael J. Cloppert, Rohan M. Amin. 2010

1,062 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/e67025655c9a99eb88dd89d1f297d1f43c3b83f6

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

1. Dan Hendrycks
2. Mantas Mazeika
3. Steven Basart
4. Percy Liang
5. Yilun Du
6. Li Deng
7. Yoshua Bengio
8. Sergey Levine

Citations in the corpus

• A taxonomy of cyber-harms: Defining the impacts of cyber-attacks and understanding how they propagate (2018, background): “This is a very different lens to that of a kill-chain [82], which seeks to explain the phases of an attack.”
• The AI-Based Cyber Threat Landscape (2020, methodology): “To build the framework from the extracted information of analyzing the existing case studies in the literature, we adopted the Cyber Kill Chain as a core in our framework because it provides a well-defined sequence of stages in a cyber attack.”
• A Study on Advanced Persistent Threats (2014, unknown): “Intelligence-driven defense is not a specific defense solution, it is a defense strategy that leverage the knowledge about the adversaries, and adapt defense based on the gathered intelligence [7].”
• On the Security of Machine Learning in Malware C&C Detection (2016, background): “This is the so-called kill chain approach to defence [Hutchins et al. 2010].”
• Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams (2017, methodology): “Both neural network models use tanh for the hidden activation function and are trained using the ADAM (Kingma and Ba 2014) variant of gradient descent.”
• Detecting and Preventing Cyber Insider Threats: A Survey (2018, background): “The last phase is referred to as ‘actions on objectives’ in the kill chain, indicating that the masquerader has accomplished the first six phases and now can take actions to achieve the original objectives [7].”
• Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense (2019, methodology): “highly sensitive information, such as proprietary corporate information or national security secrets [82].”
• Tactical Provenance Analysis for Endpoint Detection and Response Systems (2020, methodology): “To tackle the threat alert fatigue problem, we present meth-ods of triaging threat alerts based on analysis of the associated TPGs. APT attacks usually conform to a “kill chain” where attackers perform sequential actions to achieve their goals [44], [45].”
• The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning (2024, background): “In cybersecurity, AI may aid malicious actors throughthe stages of a cyberattack: reconnaissance, weaponization, exploitation, and post-exploitation (Strom et al., 2020; Hutchins et al., 2011).”
• TTPDrill: Automatic and Accurate Extraction of Threat Actions from Unstructured Text of CTI Sources (2017, methodology): “Cyber aacks have been rapidly increasing in both volume and sophistication[12].”