Zobraziť v EDS

THREATMOSAIC: collection, curation and enrichment of indicators of compromise (IOCs).

Uložené v:
Podrobná bibliografia
Názov: THREATMOSAIC: collection, curation and enrichment of indicators of compromise (IOCs).
Autori: Martínez Monterrubio, Sergio Mauricio, Frausto Solís, Juan, Recio García, Juan Antonio
Zdroj: International Journal of Combinatorial Optimization Problems & Informatics; May-Aug2025, Vol. 16 Issue 3, p441-457, 17p
Predmety: CLASSIFICATION, DATA analysis, ELECTRONIC data processing, RISK assessment, CYBER intelligence (Computer security), COMPUTER network protocols
Abstrakt: In this research experimental software is developed for the classification, analysis and enrichment of indicators of compromise (IOCs), codenamed THREATMOSAIC. This software can import IOCs in bulk, classifying them according to whether they are IPv4, IPv6, URLs, MACs, e-mails, DNS domains or MD5, SHA1 and SHA256 hashes, sorting and sanitizing them in an effective and efficient way. All this is combined with the STIX2.1 standard, generating a directional graph enriched with information obtained from analysis through third-party REST APIs. Mainly information collected through services such as Virus Total, Abuse IPDB, IP Stack or Whois. Finally, the software allows sharing threat information in STIX2.1 format through the TAXII protocol via a server to which requests can be made from threat exchange platforms. [ABSTRACT FROM AUTHOR]
Copyright of International Journal of Combinatorial Optimization Problems & Informatics is the property of International Journal of Combinatorial Optimization Problems & Informatics and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)
Databáza: Complementary Index
Popis
Abstrakt:In this research experimental software is developed for the classification, analysis and enrichment of indicators of compromise (IOCs), codenamed THREATMOSAIC. This software can import IOCs in bulk, classifying them according to whether they are IPv4, IPv6, URLs, MACs, e-mails, DNS domains or MD5, SHA1 and SHA256 hashes, sorting and sanitizing them in an effective and efficient way. All this is combined with the STIX2.1 standard, generating a directional graph enriched with information obtained from analysis through third-party REST APIs. Mainly information collected through services such as Virus Total, Abuse IPDB, IP Stack or Whois. Finally, the software allows sharing threat information in STIX2.1 format through the TAXII protocol via a server to which requests can be made from threat exchange platforms. [ABSTRACT FROM AUTHOR]
ISSN:20071558
DOI:10.61467/2007.1558.2025.v16i3.848