A Survey on Threat Hunting in Enterprise Networks

被引:13
|
作者
Nour, Boubakr [1 ,2 ]
Pourzandi, Makan [2 ]
Debbabi, Mourad [1 ]
机构
[1] Concordia Univ, Concordia Inst Informat Syst Engn, Gina Cody Sch Engn & Comp Sci, Montreal, PQ H3G 1M8, Canada
[2] Ericsson, GFTL Secur Res, Montreal, PQ H4S 0B6, Canada
来源
IEEE COMMUNICATIONS SURVEYS AND TUTORIALS | 2023年 / 25卷 / 04期
关键词
Security; Surveys; Threat modeling; Computer security; Tutorials; Systematics; Organizations; Cybersecurity; cyber threat intelligence; threat hunting; threat detection; INTRUSION DETECTION; ARTIFICIAL-INTELLIGENCE; SECURITY; CHALLENGES; CYBERSECURITY; FRAMEWORK; PREDICTION; ANALYTICS; INTERNET;
D O I
10.1109/COMST.2023.3299519
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
With the rapidly evolving technological landscape, the huge development of the Internet of Things, and the embracing of digital transformation, the world is witnessing an explosion in data generation and a rapid evolution of new applications that lead to new, wider, and more sophisticated threats that are complex and hard to be detected. Advanced persistence threats use continuous, clandestine, and sophisticated techniques to gain access to a system and remain hidden for a prolonged period of time, with potentially destructive consequences. Those stealthy attacks are often not detectable by advanced intrusion detection systems (e.g., LightBasin attack was detected in 2022 and has been active since 2016). Indeed, threat actors are able to quickly and intelligently alter their tactics to avoid being detected by security defense lines (e.g., prevention and detection mechanisms). In response to these evolving threats, organizations need to adopt new proactive defense approaches. Threat hunting is a proactive security line exercised to uncover stealthy attacks, malicious activities, and suspicious entities that could circumvent standard detection mechanisms. Additionally, threat hunting is an iterative approach to generate and revise threat hypotheses endeavoring to provide early attack detection in a proactive way. The proactiveness consists of testing and validating the initial hypothesis using various manual and automated tools/techniques with the objective of confirming/refuting the existence of an attack. This survey studies the threat hunting concept and provides a comprehensive review of the existing solutions for Enterprise networks. In particular, we provide a threat hunting taxonomy based on the used technique and a sub-classification based on the detailed approach. Furthermore, we discuss the existing standardization efforts. Finally, we provide a qualitative discussion on current advances and identify various research gaps and challenges that may be considered by the research community to design concrete and efficient threat hunting solutions.
引用
收藏
页码:2299 / 2324
页数:26
相关论文
共 50 条
  • [41] Hunting for hematopoietic transcriptional networks
    Kaushansky, Kenneth
    PROCEEDINGS OF THE NATIONAL ACADEMY OF SCIENCES OF THE UNITED STATES OF AMERICA, 2018, 115 (40) : 9818 - 9820
  • [42] Science-based enterprise: Threat or opportunity
    Garnsey, E
    PHYSICS WORLD, 1997, 10 (07) : 15 - 17
  • [43] MADE: Security Analytics for Enterprise Threat Detection
    Oprea, Alina
    Li, Zhou
    Norris, Robin
    Bowers, Kevin
    34TH ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE (ACSAC 2018), 2018, : 124 - 136
  • [44] Modeling of Insider Threat using Enterprise Automaton
    Roy, Puloma
    Mazumdar, Chandan
    PROCEEDINGS OF 2018 FIFTH INTERNATIONAL CONFERENCE ON EMERGING APPLICATIONS OF INFORMATION TECHNOLOGY (EAIT), 2018,
  • [45] Survey of Enterprise Blockchains
    Shao Q.-F.
    Zhang Z.
    Zhu Y.-C.
    Zhou A.-Y.
    Ruan Jian Xue Bao/Journal of Software, 2019, 30 (09): : 2571 - 2592
  • [46] Cyber threat detection: Unsupervised hunting of anomalous commands (UHAC)
    Kayhan, Varol O.
    Agrawal, Manish
    Shivendu, Shivendu
    DECISION SUPPORT SYSTEMS, 2023, 168
  • [47] Accurate threat hunting in industrial internet of things edge devices
    Yazdinejad, Abbas
    Zolfaghari, Behrouz
    Dehghantanha, Ali
    Karimipour, Hadis
    Srivastava, Gautam
    Parizi, Reza M.
    DIGITAL COMMUNICATIONS AND NETWORKS, 2023, 9 (05) : 1123 - 1130
  • [48] From TTP to IoC: Advanced Persistent Graphs for Threat Hunting
    Berady, Aimad
    Jaume, Mathieu
    Tong, Valerie Viet Triem
    Guette, Gilles
    IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, 2021, 18 (02): : 1321 - 1333
  • [49] Modelling Indicators of Behaviour for Cyber Threat Hunting via Sysmon
    Chetwyn, Robert
    Eian, Martin
    Josang, Audun
    PROCEEDINGS OF THE 2024 EUROPEAN INTERDISCIPLINARY CYBERSECURITY CONFERENCE, EICC 2024, 2024, : 95 - 104
  • [50] A Machine Learning Approach to Threat Hunting in Malicious PDF Files
    Teymourlouei, Haydar
    Harris, Vareva E.
    2023 INTERNATIONAL CONFERENCE ON COMPUTATIONAL SCIENCE AND COMPUTATIONAL INTELLIGENCE, CSCI 2023, 2023, : 782 - 787