Analytics // Threat Intelligence
7/25/2014
01:40 PM
Connect Directly
RSS
E-Mail
100%
0%

Researchers Develop 'BlackForest' To Collect, Correlate Threat Intelligence

Researchers at the Georgia Tech Research Institute develop the BlackForest system to help organizations uncover and anticipate cyberthreats.

Whether it's on the ground or in cyberspace, knowing that an army is going to attack you ahead of time is a nice advantage to have.

That idea is the linchpin of BlackForest, a new cyber intelligence collection system developed by experts at the Georgia Tech Research Institute (GTRI). The system is meant to complement other GTRI systems that are designed to help companies and other organizations deal with sophisticated attacks.

The system works by collecting information from a variety of sources on the public Internet, such as hacker forums and other sites where malware authors and others congregate. The system then connects the information and relates it to past activities to help organizations figure out if and how they are being targeted.

Users can identify sources of information along with keywords to focus on, says Christopher Smoak, a research scientist in the GTRI's Emerging Threats and Countermeasures Division.

"The system collects information from those sources and builds a common picture of the linkages provided by the information," he tells Dark Reading. "Analysts may then utilize the interface to customize the relationships generated if desired. Further, the system also integrates a number of automated analysis mechanisms to provide a baseline clustering, classification, and correlation capability."

For instance, "we may be interested in tying a username on a forum to a user in an IRC channel," he says. "This can help us in identifying interesting people, tools, and information through various linkages. Identifying someone on a forum that has previously posted credit card information as being related to someone active in IRC speaking of a future attack may lead us to conclusions about the type, scale, and potential target for such an attack."

As another example, if attackers are coordinating a DDoS attack via social media, the BlackForest system can measure the scale of involvement, as well as who is participating, who is coordinating, and other attack specifics. This can be used to prevent attacks as organizations learn more about common methodologies for communication and coordination.

There is also value in organizations tracking certain forums to see whether data has leaked.

"You have to monitor what's out in the wild that your company or organization owns," Ryan Spanier, head of the GTRI's Threat Intelligence Branch, said in a press release. "If you have something of value, you will be attacked. Not all attacks are successful, but nearly all companies have some computers that have been compromised in one way or another. You want to find out about these as soon as possible."

Smoak offered a hypothetical example about a company named Acme that wants to protect itself. "We monitor open-source data to identify any references to Acme. All of these references are automatically cross-referenced with other collected data, which happens to provide a linkage to a known threat actor. We can utilize what we already know about this actor to identify potential targets and techniques."

Two other GTRI cyber security systems are already available -- Apiary, a malware intelligence system that helps corporate and government security officials share information about the attacks they are fighting, and Phalanx, which helps fight spear phishing attacks.

"We want to provide something that is predictive for organizations," Spanier said. "They will know that if they see certain things happening, they may need to take action to protect their networks."

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
imeena
50%
50%
imeena,
User Rank: Apprentice
7/29/2014 | 2:46:28 PM
online Demo?
Sounds great!!! I hope you will soon have an online demo
securityaffairs
100%
0%
securityaffairs,
User Rank: Ninja
7/25/2014 | 5:35:03 PM
another step in the right direction
Threat Intelligence and Information sharing are principal discipline and practices to implement and adopt to mitigate cyber threats. BlackForest is just another piece of a greater puzzle, another step in the right direction, but we need a strong commitment and a global effort to make effective such initiatives.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3051
Published: 2014-10-29
The Internet Service Monitor (ISM) agent in IBM Tivoli Composite Application Manager (ITCAM) for Transactions 7.1 and 7.2 before 7.2.0.3 IF28, 7.3 before 7.3.0.1 IF30, and 7.4 before 7.4.0.0 IF18 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s...

CVE-2014-3668
Published: 2014-10-29
Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument t...

CVE-2014-3669
Published: 2014-10-29
Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function ...

CVE-2014-3670
Published: 2014-10-29
The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly exec...

CVE-2014-3694
Published: 2014-10-29
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and ob...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.