Cyber threat detection: Unsupervised hunting of anomalous commands (UHAC)

2023 | Decision Support Systems | Citations: 0

Authors: Kayhan, Varol O.; Agrawal, Manish; Shivendu, Shivendu

Abstract: The cyber security industry is rapidly adopting threat hunting as a proactive to ... Expand

Abstract: The cyber security industry is rapidly adopting threat hunting as a proactive tool for early and faster detection of suspected malicious actors. In this paper, we propose a machine learning-based method, Unsupervised Hunting of Anomalous Commands (UHAC), to detect text-based anomalous commands in security information and event management (SIEM) logs that are good candidates for threat hunting. A unique feature of the proposed method is that it first creates a feature set based on the augmentation of document-term and document-character matrices. Then, an autoencoder-based detector is trained on this feature set using a custom loss function. UHAC consis­ tently outperforms other feature sets and algorithms such as one-class support vector machine, density-based spatial clustering of applications with noise, and word-embedding based models such as word2vec. The UHAC detector identifies 84–89% of anomalies in the top 10% of the data. Findings have implications for cybersecurity analysts who perform threat hunting in SIEM logs for process auditing on endpoint devices. Collapse

Topics: IT security artificial intelligence Python decision support system email phishing

Methods: autoencoder data transformation DBSCAN anomaly detection machine learning

Deep Reinforcement Learning in the Advanced Cybersecurity Threat Detection and Protection

2023 | Information Systems Frontiers | Citations: 1

Authors: Sewak, Mohit; Sahay, Sanjay K.; Rathore, Hemant

Abstract: The cybersecurity threat landscape has lately become overly complex. Threat acto ... Expand

Abstract: The cybersecurity threat landscape has lately become overly complex. Threat actors leverage weaknesses in the network and endpoint security in a very coordinated manner to perpetuate sophisticated attacks that could bring down the entire network and many critical hosts in the network. To defend against such attacks, cybersecurity solutions are upgrading from the traditional to advanced deep and machine learning defense mechanisms for threat detection and protection. The application of these techniques has been reviewed well in the scientific literature. Deep Reinforcement Learning has shown great promise in developing AI solutions for areas that had earlier required advanced human cognizance. Different techniques and algorithms under deep reinforcement learning have shown great promise in applications ranging from games to industrial processes, where it is claimed to augment systems with general AI capabilities. These algorithms have recently also been used in cybersecurity, especially in threat detection and protection, where these are showing state-of-the-art results. Unlike supervised machine learning and deep learning, deep reinforcement learning is used in more diverse ways and is empowering many innovative applications in the threat defense landscape. However, there does not exist any comprehensive review of deep reinforcement learning applications in advanced cybersecurity threat detection and protection. Therefore, in this paper, we intend to fill this gap and provide a comprehensive review of the different applications of deep reinforcement learning in this field. Collapse

Topics: mobile system denial of service attack internet of things IT security malware

Methods: machine learning computational algorithm deep learning reinforcement learning supervised learning

The Phishing Funnel Model: A Design Artifact to Predict User Susceptibility to Phishing Websites

2021 | Information Systems Research | Citations: 17

Authors: Abbasi, Ahmed; Dobolyi, David; Vance, Anthony; Zahedi, Fatemeh Mariam

Abstract: Phishing is a significant security concern for organizations, threatening employ ... Expand

Abstract: Phishing is a significant security concern for organizations, threatening employees and members of the public. Phishing threats against employees can lead to severe security incidents, whereas those against the public can undermine trust, satisfaction, and brand equity. At the root of the problem is the inability of Internet users to identify phishing attacks even when using anti-phishing tools. We propose the phishing funnel model (PFM), a design artifact for predicting user susceptibility to phishing websites. PFM incorporates user, threat, and tool-related factors to predict actions during four key stages of the phishing process: visit, browse, consider legitimate, and intention to transact. We used a support vector ordinal regression with a custom kernel encompassing a cumulative-link mixed model for representing users’ decisions across funnel stages. We evaluated the efficacy of PFM in a 12-month longitudinal field experiment in two organizations involving 1,278 employees and 49,373 phishing interactions. PFM significantly outperformed competing models/methods by 8%–52% in area under the curve, correctly predicting visits to high-severity threats 96% of the time—a result 10% higher than the nearest competitor. A follow-up three-month field study revealed that employees using PFM were significantly less likely to interact with phishing threats relative to comparison models and baseline warnings. Furthermore, a cost-benefit analysis showed that interventions guided by PFM resulted in phishing-related cost reductions of nearly $1,900 per employee more than comparison prediction methods. These results indicate strong external validity for PFM. Our findings have important implications for practice by demonstrating (1) the effectiveness of predicting user susceptibility to phishing as a real-time protection strategy, (2) the value of modeling each stage of the phishing process together, rather than focusing on a single user action, and (3) the considerable impact of anti-phishing tool and threat-related factors on susceptibility to phishing. Collapse

Topics: phishing electronic mail phishing website website cost benefit analysis

Methods: survey experiment field experiment machine learning longitudinal research

Theories: technology acceptance model protection motivation theory