A Survey on Threat Hunting in Enterprise Networks

被引:13
|
作者
Nour, Boubakr [1 ,2 ]
Pourzandi, Makan [2 ]
Debbabi, Mourad [1 ]
机构
[1] Concordia Univ, Concordia Inst Informat Syst Engn, Gina Cody Sch Engn & Comp Sci, Montreal, PQ H3G 1M8, Canada
[2] Ericsson, GFTL Secur Res, Montreal, PQ H4S 0B6, Canada
来源
IEEE COMMUNICATIONS SURVEYS AND TUTORIALS | 2023年 / 25卷 / 04期
关键词
Security; Surveys; Threat modeling; Computer security; Tutorials; Systematics; Organizations; Cybersecurity; cyber threat intelligence; threat hunting; threat detection; INTRUSION DETECTION; ARTIFICIAL-INTELLIGENCE; SECURITY; CHALLENGES; CYBERSECURITY; FRAMEWORK; PREDICTION; ANALYTICS; INTERNET;
D O I
10.1109/COMST.2023.3299519
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
With the rapidly evolving technological landscape, the huge development of the Internet of Things, and the embracing of digital transformation, the world is witnessing an explosion in data generation and a rapid evolution of new applications that lead to new, wider, and more sophisticated threats that are complex and hard to be detected. Advanced persistence threats use continuous, clandestine, and sophisticated techniques to gain access to a system and remain hidden for a prolonged period of time, with potentially destructive consequences. Those stealthy attacks are often not detectable by advanced intrusion detection systems (e.g., LightBasin attack was detected in 2022 and has been active since 2016). Indeed, threat actors are able to quickly and intelligently alter their tactics to avoid being detected by security defense lines (e.g., prevention and detection mechanisms). In response to these evolving threats, organizations need to adopt new proactive defense approaches. Threat hunting is a proactive security line exercised to uncover stealthy attacks, malicious activities, and suspicious entities that could circumvent standard detection mechanisms. Additionally, threat hunting is an iterative approach to generate and revise threat hypotheses endeavoring to provide early attack detection in a proactive way. The proactiveness consists of testing and validating the initial hypothesis using various manual and automated tools/techniques with the objective of confirming/refuting the existence of an attack. This survey studies the threat hunting concept and provides a comprehensive review of the existing solutions for Enterprise networks. In particular, we provide a threat hunting taxonomy based on the used technique and a sub-classification based on the detailed approach. Furthermore, we discuss the existing standardization efforts. Finally, we provide a qualitative discussion on current advances and identify various research gaps and challenges that may be considered by the research community to design concrete and efficient threat hunting solutions.
引用
收藏
页码:2299 / 2324
页数:26
相关论文
共 50 条
  • [1] SteinerLog: Prize Collecting the Audit Logs for Threat Hunting on Enterprise Network
    Bhattarai, Bibek
    Huang, Howie
    ASIA CCS'22: PROCEEDINGS OF THE 2022 ACM ASIA CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY, 2022, : 97 - 108
  • [2] A Survey on Cross-Architectural IoT Malware Threat Hunting
    Raju, Anandharaju Durai
    Abualhaol, Ibrahim Y.
    Giagone, Ronnie Salvador
    Zhou, Yang
    Huang, Shengqiang
    IEEE ACCESS, 2021, 9 : 91686 - 91709
  • [3] Developing a threat model for enterprise storage area networks
    DeCusatis, Casimer
    2006 IEEE Information Assurance Workshop, 2006, : 9 - 14
  • [4] A framework for effective threat hunting
    Bhardwaj A.
    Goundar S.
    Network Security, 2019, 2019 (06): : 15 - 19
  • [5] Bushmeat Hunting As Climate Threat
    Brodie, Jedediah F.
    Gibbs, Holly K.
    SCIENCE, 2009, 326 (5951) : 364 - 365
  • [6] Utilizing Cyber Threat Hunting Techniques to Find Ransomware Attacks: A Survey of the State of the Art
    Aldauiji, Fatimah
    Batarfi, Omar
    Bayousef, Manal
    IEEE ACCESS, 2022, 10 : 61695 - 61706
  • [7] The miners strike – addressing the crypto-currency threat to enterprise networks
    Caldwell T.
    Computer Fraud and Security, 2018, 2018 (05): : 8 - 14
  • [8] Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligence
    Gao, Peng
    Shao, Fei
    Liu, Xiaoyuan
    Xiao, Xusheng
    Qin, Zheng
    Xu, Fengyuan
    Mittal, Prateek
    Kulkarni, Sanjeev R.
    Song, Dawn
    2021 IEEE 37TH INTERNATIONAL CONFERENCE ON DATA ENGINEERING (ICDE 2021), 2021, : 193 - 204
  • [9] Merging Threat Modeling with Threat Hunting for Dynamic Cybersecurity Defense
    Nour, Boubakr
    Ujjwal, Sonika
    Karacay, Leyli
    Laaroussi, Zakaria
    Gulen, Utku
    Tomur, Emrah
    Pourzandi, Makan
    IEEE Internet of Things Magazine, 2024, 7 (06): : 28 - 34
  • [10] Methods for Automating Threat Hunting and Response
    Adedoyin, Anthony
    Teymourlouei, Haydar
    INTERNATIONAL CONFERENCE ON ELECTRICAL, COMPUTER AND ENERGY TECHNOLOGIES (ICECET 2021), 2021, : 1607 - 1612