Cyber Threat Hunting: A Cognitive Endpoint Behavior Analytic System

Muhammad Salman Khan, Rene Richard, Heather Molyneaux, Danick Cote-Martel, Henry Jackson Kamalanathan Elango, Steve Livingstone, Manon Gaudet, Dave Trask

Source Title: International Journal of Cognitive Informatics and Natural Intelligence (IJCINI)15(4)

ISSN: 1557-3958|EISSN: 1557-3966|EISBN13: 9781799859857|DOI: 10.4018/IJCINI.20211001.oa9

Cite Article Cite Article

MLA

Khan, Muhammad Salman, et al. "Cyber Threat Hunting: A Cognitive Endpoint Behavior Analytic System." IJCINI vol.15, no.4 2021: pp.1-23. http://doi.org/10.4018/IJCINI.20211001.oa9

APA

Khan, M. S., Richard, R., Molyneaux, H., Cote-Martel, D., Kamalanathan Elango, H. J., Livingstone, S., Gaudet, M., & Trask, D. (2021). Cyber Threat Hunting: A Cognitive Endpoint Behavior Analytic System. International Journal of Cognitive Informatics and Natural Intelligence (IJCINI), 15(4), 1-23. http://doi.org/10.4018/IJCINI.20211001.oa9

Chicago

Khan, Muhammad Salman, et al. "Cyber Threat Hunting: A Cognitive Endpoint Behavior Analytic System," International Journal of Cognitive Informatics and Natural Intelligence (IJCINI) 15, no.4: 1-23. http://doi.org/10.4018/IJCINI.20211001.oa9

Export Reference

Favorite Full-Issue Download

View Full Text HTML

View Full Text PDF

Abstract

Security and Information Event Management (SIEM) systems require significant manual input; SIEM tools with machine learning minimizes this effort but are reactive and only effective if known attack patterns are captured by the configured rules and queries. Cyber threat hunting, a proactive method of detecting cyber threats without necessarily knowing the rules or pre-defined knowledge of threats, still requires significant manual effort and is largely missing the required machine intelligence to deploy autonomous analysis. This paper proposes a novel and interactive cognitive and predictive threat-hunting prototype tool to minimize manual configuration tasks by using machine intelligence and autonomous analytical capabilities. This tool adds proactive threat-hunting capabilities by extracting unique network communication behaviors from multiple endpoints autonomously while also providing an interactive UI with minimal configuration requirements and various cognitive visualization techniques to help cyber experts quickly spot events of cyber significance from high-dimensional data.