Riba:
- Ƙarfin fahimtar cewa basirar wucin gadi yana taƙaita rahotannin barazana mai tsawo a matakai uku (dabarun, dabara, fasaha) kuma ya tsara su zuwa MITER ATT & CK ta hanyar cire IOC da TTP.
- Ikon tabbatar da kowane IOC tare da tushen zaman kansa na yanzu da na biyu, kowace dabara a cikin ATT & CK da fitar da IOC / fasaha / rukuni
- Ƙarfin fahimtar cewa ra'ayi na rukuni shine mafi haɗari, cewa ya kamata a yi amfani da harshen 'wanda ya dace da dabaru' maimakon 'ƙungiyar daidai' kuma ya kamata tsaro ya dogara ne akan ƙaddarar TTP na dindindin.
Tawagar tsaro kadai ba wai kawai ta yaki hare-haren da take gani ba; koya ta hanyar raba ilimin hare-hare a duniya. Sirrin barazanar (TI a takaice) shine bayanan da aka tattara, sarrafawa da kuma juya su zuwa aiki game da maharan, kayan aikin da suke amfani da su, makasudin su da hanyoyin su. "Wane malware ne ke yadawa yanzu?", "Wane bangare ne wannan rukunin masu kai hari kuma ta yaya yake aiki?", "Shin an ga wannan adireshin IP a wani hari a baya?" Amsoshin tambayoyi irin waɗannan sun fito ne daga basirar barazanar.
Matsalar ita ce basirar barazanar tana da yawa kuma tana tarwatsewa: rahotanni, shafukan yanar gizo, ciyarwa, taron tattaunawa, dubban IOCs. AI yana da ƙarfi wajen yin ma'anar wannan tari: yana taƙaita rahotanni masu tsayi masu tsayi, fitar da IOC da TTP da aka tsara daga labarin harin, taswira su zuwa tsarin MITER ATT&CK, kuma yana tambaya "Shin wannan ya shafe mu?" yana shirya daftarin farko na tambayar. Amma AI na iya kuskuren tsofaffi, kuskure, ko bayanan sirri a matsayin gaskiya, kafa ƙungiyar barazanar da ba ta wanzu ko IOC, kuma ba su sani ba ko hankali yana da inganci ga ƙungiyar ku. AI ta taƙaita, tsari da basirar taswira; Ya rage ga manazarci don toshe wani IOC, yi amfani da bayanan sirri ga hukumar, kuma ya ayyana rahoton “mai yiwuwa.”
Layer na barazanar hankali
Ana la'akari da basirar barazanar a matakai uku:
- Fasaha/aikin aiki (matakin IOC): Mahimman bayanai - munanan IPs, yanki, hashes, URLs. Yana da ɗan gajeren lokaci (mai kai hari yana canza IP). AI yana saurin fitar da waɗannan daga rahoton da tsara su.
- Dabarar (matakin TTP): Yadda maharin ke nuna hali - menene dabaru, kayan aiki, hanyoyin da yake amfani da su. Ya fi dindindin (halayen yana da wuya a canza). MITER ATT&CK shine yaren gama gari na wannan matakin.
- Dabarun: Wanene ke niyya, me yasa, wane yanki, tare da wane hali. Yana ciyar da yanke shawara na gudanarwa. AI yana taƙaita dogon rahotanni a wannan matakin.
Sharuɗɗan: IOC (Mai nuna Ƙarfafawa - mai nuna alamar cin zarafi, alamar fasaha na kankare). TTP (Dabarun, Dabaru, Tsarukan - tsarin halayya). MITER ATT&CK, lamba, daftarin ɗakin karatu na dabarun maharan (misali T1566 "Phishing"). APT (Babban Barazana Mai Dagewa - ci gaba, dagewa, ƙungiyar maharan da ke ɗaukar nauyin jihohi). Ciyarwa, sabunta rafin IOC ta atomatik. Ba daidai ba, danganta harin ga ƙungiyar da ba ta dace ba; Shi ne mafi yawan kuskuren hankali.
Jadawalin kimanta tushen basira
ma'auni
tambayar da za a yi
Me yasa yake da mahimmanci?
Yanzu
Yaushe aka buga shi? Shin har yanzu yana aiki?
IOCs sun zama mara amfani da sauri
Amintaccen tushe
Wanene ya buga shi, menene sunan sa?
Yawancin basirar ƙarya / ƙirƙira
Dace
Shin yana kai mu/masana'antar mu?
Ba kowace barazana ce barazanar ku ba
Tabbatarwa
Shin wata majiya ta biyu ta tabbatar da hakan?
Madogara ɗaya bai isa ba
Yin aiki
Me zan iya yi (toshewa, waƙa, kira)
Dole ne ilimi ya koma aiki
Daidaiton ambato
Yaya ƙaƙƙarfan halayen rukuni?
Rashin kuskure yana yaudarar
uku mini lokuta
Case 1 - Daga rahoton shafi 40 zuwa aiki. Wani manazarci yana da AI ta taƙaita rahoton barazanar shafi 40 game da sabon kamfen na ransomware. AI yana rage rahoton zuwa shafi na 1, yana fitar da 32 IOC (IP, hash, domain) da fasaha na 7 MITER ATT & CK, kuma ya lura "wannan rukuni yana nufin masana'antar ku." Manazarci yana tabbatar da kowane ɗayan IOCs tare da tushe na biyu, yana ƙara 21 waɗanda har yanzu suna aiki a cikin jerin agogon, ya tabbatar da lambobin ATT&CK na dabarun, kuma yana haɓaka shi zuwa hasashen farauta na barazanar. AI ta sanya shafuka 40 masu iya sarrafawa; tabbatarwa da aiki sun kasance na manazarta.
Case 2 - Ƙungiya ta APT. Wani manazarci ya tambayi AI "wace kungiya ce ta kai wannan harin?" Ya tambaya. AI da amincewa ya ba da amsa: "Wannan ita ce sanannun fasaha na ƙungiyar 'APT-Dark Eagle'." Manazarcin yana neman wannan ƙungiyar a sanannun kafofin leƙen asiri na barazanar - babu irin wannan ƙungiyar, ƙirar ta ƙunshi sunan. Idan bai tabbatar da hakan ba, da rahoton ya fita da sifa da ba daidai ba. Darasi: Dangantakar ƙungiya ita ce mafi sauƙi kuma mafi haɗari da'awar yin; Sanannen tushe ne koyaushe ke tabbatar da shi kuma galibi ana kiransa da “mai jituwa da dabaru masu zuwa” maimakon “daidaitaccen sifa”.
Case 3 - Katange karya tare da tsohon IOC. Wata ƙungiya ta tambayi AI "ba za mu toshe" jerin IPs da ta samu daga rahoton watannin da suka gabata ba? yana tambaya; AI ta ce "eh, suna da mugunta." Amma manazarci yana ganin cewa ɗayan IP ɗin yanzu yana cikin halaltaccen mai ba da girgije (CDN); Toshe waccan IP ɗin zai kuma yanke halaltattun ayyukan da ƙungiyar ke shiga. IOCs na ɗan gajeren lokaci ne. Manazarci yana tabbatar da halin yanzu kuma yana kawar da waɗanda suka tsufa. Darasi: Ba ya shiga cikin jerin toshewar har sai IOC ya tabbatar da kasancewarsa.
Rauni mai ƙarfi / Ƙarfi mai ƙarfi
Rawanin faɗakarwa:
Wanene ya kai wannan hari kuma waɗanne IPs zan toshe? [rahoto]
Wannan buƙatun yana buƙatar takamaiman sifa da yanke shawara kai tsaye daga AI, baya buƙatar lokaci da tabbatarwa, yana buɗewa ga ƙirƙira. AI na iya bayar da gamsasshiyar amma mara inganci da jerin abubuwan da suka gabata na IOC.
Ƙarfi mai ƙarfi:
Matsayin ku: mataimaki ga manazarci yana shirya bayanan sirrin barazanar TAKAMAI da TSIRA. Yanke shawara; Kar a ce “block”, kar a yi takamaiman bayanin rukuni. Gudanar da rahoton mai zuwa: (1) cire taƙaitaccen shafi na 1 (wanda, menene, manufa, hanya), (2) tsararrun jerin IOCs (IP, yanki, hash, URL); alamar "[a halin yanzu da na biyu dole ne a tabbatar da tushe]" ga kowane; ƙara dummy IOC, (3) taswirar TTPs zuwa MITER ATT&CK amma yiwa kowane T-lamba "[tabbatar a ATT&CK]", (4) kar a ce "ainihin ƙungiyar" don sifa; Yi amfani da yaren "mai jituwa da waɗannan fasahohin" kuma bayyana ƙarfin shaida, (5) rubuta tambayoyi kan dalilin da yasa wannan hankali zai iya amfani da masana'antarmu/gine-gine. Rahoton: [manna]
Da'awar mai ƙarfi tana neman taƙaitaccen tsari +, yana barin kowane IOC/TTP don tabbatarwa, yana hana madaidaicin sifa, dacewa da tambayoyi.
Samfuran gaggawar da za a iya kwafi
TAKAITACCEN BAYANIN LABARI Taƙaita rahoton barazanar mai zuwa a matakan 3: (1) dabarun (wanda, me yasa, ɓangaren manufa), (2) dabara (TTPs da aka yi amfani da su), (3) fasaha (nau'ikan IOCs) .Kada ku wuce shafi 1. Kada ku haɗa da duk wani ikirarin da ba ku cire ba daga rahoton; ƙirƙira.Rahoto: [manna]
IOC EXTRACTION TEMPLATEExtracts da aka tsara IOCs daga rubutu mai zuwa: nau'in (IP/domain/hash/URL/email),daraja, mahallin. Dauki kawai abin da aka bayyana a sarari a cikin rubutu; dacewa. Duba "[na yanzu + na biyu dole ne a tabbatar da shi]" ga kowane IOC. Tabbatar da sigar tambura.Text: [manna]
ATT&CK MATCHING TEMPLATETaswirar halaye a cikin labarin harin zuwa dabara da dabaru MITER ATT&CK. Ga kowane taswira: ƙimar ɗabi'a + sunan fasaha da aka ba da shawarar +"[Tilas ne a tabbatar da lambar T a cikin ATT&CK]". Kada ku ba da dabara / lamba; idan ba ku da tabbas, rubuta "[unclear]". Ruwayar: [Paste]
TAMBAYA TAIMAKO Taimaka min kimanta ko wannan bayanan na barazanar ya shafi ƙungiyarmu: samar da tambayoyin wanne daga cikin kadarorin mu ya dace da fasaha/masana'antu. Yanke shawara; Ka ba ni lissafin lissafi. Takaitacciyar hankali: [manna]
Kuskuren gama gari
- Yin daidaitattun sifa ta rukuni. Siffar ita ce yanki mafi wahala da rashin fahimta; Maimakon "daidai waccan ƙungiyar", ce "masu jituwa da waɗannan fasahohin" kuma tabbatar da tushen.
- Toshe IOC ba tare da tabbatar da kuɗi ba. IOCs ba su da ɗan gajeren lokaci; Tsohon IP na iya kasancewa yanzu yana cikin halaltaccen sabis, bincika fara sabo.
- Amincewa da tushe guda ɗaya. Tabbatar da hankali tare da tushe mai zaman kansa na biyu; Akwai da yawa na ƙarya / ƙirƙira hankali.
- Ba tambayar dacewa. Ba kowace barazana ce barazanar ku ba; Dubi masana'antu, fasaha da haɗin gine-gine.
- Ƙirƙirar IOC/fasahar / ƙungiya suna tunanin gaskiya ne. AI na iya daidaita su da kyau; tabbatar da kowane a sanannen tushe da MITER ATT&CK.
Tukwici: Mafi juriya da ƙimar hankali na barazanar barazanar shine TTP, ba IOC ba. Maharin yana canza adireshin IP a rana ɗaya, amma yana da wuya a canza yanayin halayensa (TTP). Gina tsaron ku akan gano TTP, ba tare da IOC ba.
Tsanaki: Sanya IOC akan jerin toshewa na iya hana halaltaccen zirga-zirga (tange tabbataccen karya). Nuna yatsa ga ƙungiya ba daidai ba yana ɓarna albarkatu ta hanyar da ba ta dace ba. Hankali shine shigarwa; Hukuncin toshewa da ƙididdigewa ya rataya a wuyan mai sharhi bayan tabbatarwa.
A takaice
Barazanar hankali yana ba ƙungiyar damar yin yaƙi ba ita kaɗai ba amma tare da gogewar duniya; amma saboda yana da yawa, ɓatacce, kuma mai canzawa, yana buƙatar fassarar. AI ta taƙaita rahotanni masu tsawo a matakai uku (dabarun, dabara, fasaha), cire IOC da TTP, taswira zuwa MITER ATT&CK kuma yana ba da ƙayyadaddun abubuwan da suka dace. Haɗari mafi girma: IOC/fasaha/rukuni da aka yi, daidai amma sifa na ƙarya, da kuma IOC da ba a gama ba. Shi ya sa kowane IOC aka inganta tare da halin yanzu da na biyu tushe, kowace dabara da aka tabbatar a ATT & CK; An yi nuni a cikin harshen "mai jituwa tare da dabaru" kuma ba "ƙungiyar tabbatacciyar ƙungiya" ba; kuma shawarar toshewa / tilastawa shine na manazarta. Zuciyar tsaro shine ganowar TTP na dindindin, ba IOCs na ɗan gajeren lokaci ba.
Aikin aikace-aikace
Sami rahoton barazanar jama'a samfurin samfurin. Cire taƙaitaccen jerin abubuwan da aka tsara na IOCs daga AI tare da samfuran "Takaitaccen Rahoton" da "IOC Extraction". Bincika kuɗin kuɗi da sahihancin 5 na IOCs akan sanannen tushe; Yi ƙoƙarin nemo aƙalla tsohon tsohon ko IOC mai tambaya. Tabbatar da T-lambobin dabarun da aka fitar tare da samfurin "ATT&CK Matching" akan rukunin yanar gizon MITER ATT&CK kuma kama lambar karya/ƙarya idan akwai.
jerin abubuwan dubawa
- [ ] Na taƙaita rahoton a matakai uku (dabarun, dabara, fasaha).
- [ ] Na tabbatar da kowace IOC tare da kuɗi da kuma tushen zaman kanta na biyu.
- [ ] Na tabbatar da kowace dabarar MITER ATT&CK a cikin tushen hukuma.
- [ ] Na yi magana game da batun rukuni a cikin yaren "daidai da dabaru" maimakon "daidai".
- [ ] Na yi tambaya game da mahimmancin hankali ga cibiyara (bangaren, fasaha, gine-gine).
- [ ] Na duba gaskiya-kowace da'awar, da sanin tana iya zama IOC/fasaha/rukuni.
- [ ] Na yanke shawarar toshewa da aiwatarwa a matsayin manazarci bayan tabbatarwa.