Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

7/25/2014
01:40 PM
100%
0%

Researchers Develop 'BlackForest' To Collect, Correlate Threat Intelligence

Researchers at the Georgia Tech Research Institute develop the BlackForest system to help organizations uncover and anticipate cyberthreats.

Whether it's on the ground or in cyberspace, knowing that an army is going to attack you ahead of time is a nice advantage to have.

That idea is the linchpin of BlackForest, a new cyber intelligence collection system developed by experts at the Georgia Tech Research Institute (GTRI). The system is meant to complement other GTRI systems that are designed to help companies and other organizations deal with sophisticated attacks.

The system works by collecting information from a variety of sources on the public Internet, such as hacker forums and other sites where malware authors and others congregate. The system then connects the information and relates it to past activities to help organizations figure out if and how they are being targeted.

Users can identify sources of information along with keywords to focus on, says Christopher Smoak, a research scientist in the GTRI's Emerging Threats and Countermeasures Division.

"The system collects information from those sources and builds a common picture of the linkages provided by the information," he tells Dark Reading. "Analysts may then utilize the interface to customize the relationships generated if desired. Further, the system also integrates a number of automated analysis mechanisms to provide a baseline clustering, classification, and correlation capability."

For instance, "we may be interested in tying a username on a forum to a user in an IRC channel," he says. "This can help us in identifying interesting people, tools, and information through various linkages. Identifying someone on a forum that has previously posted credit card information as being related to someone active in IRC speaking of a future attack may lead us to conclusions about the type, scale, and potential target for such an attack."

As another example, if attackers are coordinating a DDoS attack via social media, the BlackForest system can measure the scale of involvement, as well as who is participating, who is coordinating, and other attack specifics. This can be used to prevent attacks as organizations learn more about common methodologies for communication and coordination.

There is also value in organizations tracking certain forums to see whether data has leaked.

"You have to monitor what's out in the wild that your company or organization owns," Ryan Spanier, head of the GTRI's Threat Intelligence Branch, said in a press release. "If you have something of value, you will be attacked. Not all attacks are successful, but nearly all companies have some computers that have been compromised in one way or another. You want to find out about these as soon as possible."

Smoak offered a hypothetical example about a company named Acme that wants to protect itself. "We monitor open-source data to identify any references to Acme. All of these references are automatically cross-referenced with other collected data, which happens to provide a linkage to a known threat actor. We can utilize what we already know about this actor to identify potential targets and techniques."

Two other GTRI cyber security systems are already available -- Apiary, a malware intelligence system that helps corporate and government security officials share information about the attacks they are fighting, and Phalanx, which helps fight spear phishing attacks.

"We want to provide something that is predictive for organizations," Spanier said. "They will know that if they see certain things happening, they may need to take action to protect their networks."

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
securityaffairs
100%
0%
securityaffairs,
User Rank: Ninja
7/25/2014 | 5:35:03 PM
another step in the right direction
Threat Intelligence and Information sharing are principal discipline and practices to implement and adopt to mitigate cyber threats. BlackForest is just another piece of a greater puzzle, another step in the right direction, but we need a strong commitment and a global effort to make effective such initiatives.
imeena
50%
50%
imeena,
User Rank: Apprentice
7/29/2014 | 2:46:28 PM
online Demo?
Sounds great!!! I hope you will soon have an online demo
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18216
PUBLISHED: 2019-10-20
** DISPUTED ** The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access ...
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.