In this paper, we present ICtoolS, a framework for identifying ICS-capable tool fingerprints within honeypot network traffic logs, which is released as an open-source project. …
This work investigates how interaction level, network type, and geographic location affect the attractiveness of ICS honeypots. We deploy both low-and high-interaction honeypots, …
In this paper, we characterize the rules in use at a collaborating commercial (managed) SOC serving customers in sectors including education and IT management. During this process, …
We propose the SuriCap measurement platform and organize Jeopardy-style workshops in which participants compete to engineer Suricata rules. We collect a rich dataset consisting of …
In this work, we evaluate the effect of label imbalance on the classification of network intrusion alerts. As our use-case we employ DeepCASE, the state-of-the-art method for …
We identify from extant literature the relevant skills a tier-1 SOC analyst needs, and devise a test to evaluate those in collaboration with a commercial SOC. A three-month case …
We collaborate with a commercial SOC and employ two think-aloud experiments: the first evaluates the alert investigation process followed by professional T1 analysts, the second …
In this work, we collaborate with a commercial SOC to develop an alert investigation support tool to help inexperienced analysts identify and collect all the information relevant …
In this paper, we perform the first in-depth study of the operation of a large (500 KV) real-world substation automation network. Our work provides a deep-dive discussion of these …
In this paper, we profile a new threat actor, referred to as the unspecialized OT attacker, who performs targeted, OT-related cyber-attacks with at most basic generic knowledge. We …