Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Application of threat intelligence in security operation 2017-06-03

193 views

Published on

In this talk Jeremy Li talks about how to apply threat intelligence to security operations

Published in: Data & Analytics
  • Be the first to comment

Application of threat intelligence in security operation 2017-06-03

  1. 1. Application of Threat Intelligence in Security Operation Jeremy Li (elknot@360corpsec) JMPESP Lab of 360 Enterprise Security Group
  2. 2. About Me • Jeremy Li, 李中文 (elknot@360corpsec) • Sr. Security Researcher @ JMPESP Lab of 360 Enterprise Security Group • Ex-Security Operation Engineer in Qihoo 360 • Research Area: • Applications of Threat Intelligence Hierarchy (toB) • Data-Driven Security Operation
  3. 3. Outline • About Threat Intelligence • From Attack Vectors to Attack Scene Restore • Attack Traceability & Defensive Tactics • Examples
  4. 4. What is Threat Intelligence Tactical Intelligence • Found Threat Events as well as to Confirm or Priority Alarms • C&C Intelligence, IP Intelligence Operation Intelligence • Important Security Incidents Analysis • Finding Attack Related Clues From Attackers Tactical Initiatives • Alarm Confirmation, Attack Impact Range, Tactical Methods, Attack Purpose, etc. Strategy Intelligence • Attackers Organization, Tactical Abilities, Control Resources, etc.
  5. 5. Why We Need Threat Intelligence • Analysis are Restricted by Security Logs • Confirm Identities and Objectives of Attackers • Assist Security Emergency Response and Operation • Give it a Warn!
  6. 6. From Attack Vectors to Scene Restore • Data Resources • Data Analysis and Information Collection • From Logs to Threat Logs
  7. 7. Data Resources Non-Secure Devices Logs Secure Devices Logs Sensors Logs External Data Sources • System Operation Logs • Network Devices Logs • VPN Logs • IDS/WAF Logs • System Secure Logs, HIDS Agent Logs • Firewall Logs • Net-flow Sensor Logs • Honeypots/net Logs • DPI Data • Threat Intelligence • Public Infrastructures Data
  8. 8. Data Analysis and Collection • Attack Events Rating: • Blocking Attack Payloads, PoC Execution, Commands Execution, Sensitive Commands Execution, Reflect Shell, Transverse Penetration • Attack Events Statistics: • Sources, Attackers, Date & Time • Attacker Fingerprints: • Quintuple, Toolkit Fingerprints, Public Infrastructure Data, Threat Intelligence
  9. 9. From Logs to Threat Logs OS Operation Logs Net-Flow Analysis SIEM Analysis Files R/W Command Execution Operation Time Payload User-Agent Quintuple Alarm Types Alarm Trigger Time Affected Machines Behaviors, Toolkits Fingerprint, Toolkits Behavior, Address Address, Toolkits, Behavior
  10. 10. Applications of Threat Intelligence • Data-Driven Traceability Analysis • Attack Logs to Attack Traceability • Attacker Data Mining • Attacker Collection
  11. 11. Data-Driven Traceability Analysis Security Logs Threats Logs Scene Restore Traceability Portrait Analysis & Sorting Splice Restore Analysis & Traceability IDS/IPS/WAF Logs, Sensor Logs, Network Logs, Terminal Logs, etc. Affected Situation, Legacy Information, Network Logs, Attack Behavior Logs, etc. Impact of the Attackers Characteristics, Identities, IP Geo, Tags, Behavior, Tricks, etc.
  12. 12. From Logs to Traceability • Timestamp • Phase • Result • Direction • Methodology • Resources Adversary Victim Capability Infra structure Social - Political Technology
  13. 13. From Logs to Traceability Adversary Victim Capability 1.Detection 4. Event Log 3. C&C Resolve 5. Get IP Detail 2. Malicious Host Infra structure
  14. 14. From Logs to Traceability Attack Description Activity- Attack Graphs Kill-Chain Activity Thread
  15. 15. From Logs to Traceability Identity Behavior SNS Address Fingerprints Toolkits Victim(S) • Behavior + SNS = Motivation • SNS + Address + Fingerprints = Identity • Toolkits + Fingerprints = Tags • Motivation + Tags + Identity = Attacker(s)
  16. 16. Attacker Data Mining Logs Level Secure Logs Network Logs System Logs Attacker Level Attacker Characteristics External Data Sources Threat Intelligence Attacker Evaluation Attacker Motivation Attacker Behavior Attacker Identities Historical Attack Data
  17. 17. Attacker Collection White-Hat Hacker Security Teams Black Industry Black Industry Gangs Black-Hat Hacker Alliance Students Amateur Foreign Forces National Evaluation Agency Black Industry Downstream Penetration Test company Internal Security Inspection
  18. 18. Attackers Description Motivation • Nice: Compliance Testing, Security Detection • Bad: Internet Mapping, Black Industry, Botnet Identities • Good: White-Hat Hacker(s), Penetration Tests Company • Bad: Black-Hat Hackers, Black Industry Abilities • Ability Tags: Script Kids, Penetration Tester, Security Researcher • Toolkits Tags: Burpsuite, AWVS, DIY Toolkits
  19. 19. Example Time Apr 13: Consumer Received Unauthorized SMS Code Apr 15:Product Team 1st Fix Vulnerability Apr 18: Resources Usage Abnormality … … Apr 22:Product Team 2nd Fix Vulnerability
  20. 20. Example Time Security Response CC/DDoS Attacks Threat Intelligence SMS APIs Abused by Black Industry Incident Solution Waiting for New Releases
  21. 21. Example Time Struts2-045 Vulnerability Disclosure Attackers With PoC & EXP IP Address Sorting and analyzing Log Analysis and Reduction Process Tracing Back Attacker
  22. 22. Example Time • Mapping Internet with Tools • S2-045 Exploit Mapping Source Analysis 1 • 2 Servers and 1 Web Services • Attack Clear Targets Events Restore 2 • Located in ChangPing, Beijing • Network Mapping • Struts2 Exploit Attacker Portrait 3
  23. 23. Example Time Security Logs Analysis Threat Intelligence Attacker Tracing Back Restore Attack Scene Attacker Historical Behavior Find Attackers
  24. 24. Example Time Target Description Attack Source Description Attacker Description
  25. 25. Summary • Security Operation Log Analysis and Attack Events Restore • Analyze Logs and Extract Attack Data • Diamond Reference and Attack Events Restore • Threat Intelligence in Security Operations • Making Defensive Tactics • Attacker Traceability
  26. 26. Thank You

×