Loading...
Pivot attack classification for cyber threat intelligence
Marques, Rafael Salema Epiphaniou, Gregory Maple, Carsten
Marques, Rafael Salema
Epiphaniou, Gregory
Maple, Carsten
Editors
Other contributors
Affiliation
Epub Date
Issue Date
2022-10-03
Submitted date
Alternative
Abstract
The initial access achieved by cyber adversaries conducting a systematic attack against a targeted network is unlikely to be an asset of interest. Therefore, it is necessary to use lateral movement techniques to expand access to different devices within the network to accomplish the strategic attackās objectives. The pivot attack technique is widely used in this context; the attacker creates an indirect communication tunnel with the target and uses traffic forwarding methods to send and receive commands. Recognising and classifying this technique in large corporate networks is a complex task, due to the number of different events and traffic generated. In this paper, we present a pivot attack classification criteria based on perceived indicators of attack (IoA) to identify the level of connectivity achieved by the adversary. Additionally, an automatic pivot classifier algorithm is proposed to include a classification attribute to introduce a novel capability for the APIVADS pivot attack detection scheme. The new algorithm includes an attribute to differentiate between types of pivot attacks and contribute to the threat intelligence capabilities regarding the adversary modus operandi. To the best of our knowledge, this is the first academic peer-reviewed study providing a pivot attack classification criteria.
Citation
R. Salema Marques, H. al-Khateeb, G. Epiphaniou, and C. Maple (2022) Pivot Attack Classification for Cyber Threat Intelligence. Journal of Information Security and Cybercrimes Research, 5(2), pp. 91-103.
Research Unit
PubMed ID
PubMed Central ID
Embedded videos
Additional Links
Type
Journal article
Language
en
Description
Ā© 2022 The Authors. Published by Naif Arab University for Security Sciences. This is an open access article available under a Creative Commons licence. The published version can be accessed at the following link on the publisherās website: https://doi.org/10.26735/ZNTL3639
Series/Report no.
ISSN
1658-7782