Automated Detection of the Early Stages of Cyber Kill Chain

Early detection of cyber threats is critical for proactive network defence and protection against data, financial and reputation loss that could be caused by large-scale security breach. Continuous monitoring and in-depth analysis of related system and network events are required to achieve the objective. However cyber threat hunting activities are both time-consuming and labour-intensive; the prospect of being able to automate them effectively is thus worth exploring. In this paper we introduce the prototype of our attack detection tool for automating the process of discovering and correlating security events towards early threat detection. Its main objective is to facilitate continuous event monitoring and to alert security analysts whenever a series of detected events and activities may indicate early stages of a cyber kill chain. The process automation will reduce the load of human analysts and spare them valuable time to investigate more sophisticated, unknown attacks. We provide two use cases which describe the chain of tasks a security analyst would have to perform when investigating cyber incidents and trying to identify the systems targeted by potential attack. We then show how to create attack detection plans for those use cases and apply them on relevant datasets. We present the results produced by the tool and discuss our future work on contextaware classification of security events which aims to make the detection process more efficient.