Analytics // Threat Intelligence
7/25/2014
01:40 PM
Connect Directly
RSS
E-Mail
100%
0%

Researchers Develop 'BlackForest' To Collect, Correlate Threat Intelligence

Researchers at the Georgia Tech Research Institute develop the BlackForest system to help organizations uncover and anticipate cyberthreats.

Whether it's on the ground or in cyberspace, knowing that an army is going to attack you ahead of time is a nice advantage to have.

That idea is the linchpin of BlackForest, a new cyber intelligence collection system developed by experts at the Georgia Tech Research Institute (GTRI). The system is meant to complement other GTRI systems that are designed to help companies and other organizations deal with sophisticated attacks.

The system works by collecting information from a variety of sources on the public Internet, such as hacker forums and other sites where malware authors and others congregate. The system then connects the information and relates it to past activities to help organizations figure out if and how they are being targeted.

Users can identify sources of information along with keywords to focus on, says Christopher Smoak, a research scientist in the GTRI's Emerging Threats and Countermeasures Division.

"The system collects information from those sources and builds a common picture of the linkages provided by the information," he tells Dark Reading. "Analysts may then utilize the interface to customize the relationships generated if desired. Further, the system also integrates a number of automated analysis mechanisms to provide a baseline clustering, classification, and correlation capability."

For instance, "we may be interested in tying a username on a forum to a user in an IRC channel," he says. "This can help us in identifying interesting people, tools, and information through various linkages. Identifying someone on a forum that has previously posted credit card information as being related to someone active in IRC speaking of a future attack may lead us to conclusions about the type, scale, and potential target for such an attack."

As another example, if attackers are coordinating a DDoS attack via social media, the BlackForest system can measure the scale of involvement, as well as who is participating, who is coordinating, and other attack specifics. This can be used to prevent attacks as organizations learn more about common methodologies for communication and coordination.

There is also value in organizations tracking certain forums to see whether data has leaked.

"You have to monitor what's out in the wild that your company or organization owns," Ryan Spanier, head of the GTRI's Threat Intelligence Branch, said in a press release. "If you have something of value, you will be attacked. Not all attacks are successful, but nearly all companies have some computers that have been compromised in one way or another. You want to find out about these as soon as possible."

Smoak offered a hypothetical example about a company named Acme that wants to protect itself. "We monitor open-source data to identify any references to Acme. All of these references are automatically cross-referenced with other collected data, which happens to provide a linkage to a known threat actor. We can utilize what we already know about this actor to identify potential targets and techniques."

Two other GTRI cyber security systems are already available -- Apiary, a malware intelligence system that helps corporate and government security officials share information about the attacks they are fighting, and Phalanx, which helps fight spear phishing attacks.

"We want to provide something that is predictive for organizations," Spanier said. "They will know that if they see certain things happening, they may need to take action to protect their networks."

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
imeena
50%
50%
imeena,
User Rank: Apprentice
7/29/2014 | 2:46:28 PM
online Demo?
Sounds great!!! I hope you will soon have an online demo
securityaffairs
100%
0%
securityaffairs,
User Rank: Ninja
7/25/2014 | 5:35:03 PM
another step in the right direction
Threat Intelligence and Information sharing are principal discipline and practices to implement and adopt to mitigate cyber threats. BlackForest is just another piece of a greater puzzle, another step in the right direction, but we need a strong commitment and a global effort to make effective such initiatives.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1032
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party inf...

CVE-2012-1417
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

CVE-2012-1506
Published: 2014-09-17
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from th...

CVE-2012-1507
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index...

CVE-2012-2583
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.

Best of the Web
Dark Reading Radio