1. Private sharing of IOCs and sightings
- Author
-
Kamp, T.R. van de, Peter, A., Everts, M.H., and Jonker, W.
- Subjects
Graphic approaches ,Information sharing ,TS - Technical Sciences ,Information analysis ,Complementary techniques ,Private information sharing ,Information dissemination ,Proof of concept ,CSR - Cyber Security & Robustness ,Trust relationship ,ICT ,Cryptography ,Private information ,Evaluation ,Open sources - Abstract
Information sharing helps to better protect computer sys- tems against digital threats and known attacks. However, since security information is usually considered sensitive, parties are hesitant to share all their information through public channels. Instead, they only exchange this informa- tion with parties with whom they already established trust relationships. We propose the use of two complementary techniques to allow parties to share information without the need to im- mediately reveal private information. We consider a crypto- graphic approach to hide the details of an indicator of com- promise so that it can be shared with other parties. These other parties are still able to detect intrusions with these cryptographic indicators. Additionally, we apply another cryptographic construction to let parties report back their number of sightings to a central party. This central party can aggregate the messages from the various parties to learn the total number of sightings for each indicator, without learning the number of sightings from each individual party. An evaluation of our open-source proof-of-concept imple- mentations shows that both techniques incur only little over- head, making the techniques prime candidates for practice. © 2016 ACM. ACM SIGSAC
- Published
- 2016