ATHAFI：敏捷威胁搜索和取证调查
ATHAFI: Agile Threat Hunting And Forensic Investigation
摘要：
攻击者迅速改变攻击方式以逃避检测。即使是基于人工智能和高级数据分析的最复杂的入侵检测系统也无法跟上新攻击的快速发展。当标准检测机制失败或无法提供足够的取证信息来调查和减轻攻击时，将使用由合格人员执行的有针对性的威胁搜索。不幸的是，许多组织没有足够的安全分析师来执行威胁搜索任务，而且目前威胁搜索的自动化水平很低。在本文中，我们描述了一个敏捷的威胁狩猎和取证调查（ATHAFI），自动化的威胁狩猎过程在多个层次的框架。自适应目标数据汇集、攻击假设生成、假设测试和持续威胁情报馈送允许以完全自动化的方式执行简单的调查。自动化水平的提高将大大提高分析师在调查最严重案件时的工作效率。特殊工作流生成模块根据从外部来源（例如国家CERT）获得的最新威胁情报或攻击假设生成模块生成的最可能的攻击假设调整威胁搜索程序。攻击假设生成和工作流生成的组合可以智能调整工作流，从而有效地应对新出现的威胁。
英文摘要：
Attackers rapidly change their attacks to evade detection. Even the most sophisticated Intrusion Detection Systems that are based on artificial intelligence and advanced data analytic cannot keep pace with the rapid development of new attacks. When standard detection mechanisms fail or do not provide sufficient forensic information to investigate and mitigate attacks, targeted threat hunting performed by competent personnel is used. Unfortunately, many organization do not have enough security analysts to perform threat hunting tasks and today the level of automation of threat hunting is low. In this paper we describe a framework for agile threat hunting and forensic investigation (ATHAFI), which automates the threat hunting process at multiple levels. Adaptive targeted data collection, attack hypotheses generation, hypotheses testing, and continuous threat intelligence feeds allow to perform simple investigations in a fully automated manner. The increased level of automation will significantly boost the analyst's productivity during investigation of the harshest cases. Special Workflow Generation module adapts the threat hunting procedures either to the latest Threat Intelligence obtained from external sources (e.g. National CERT) or to the likeliest attack hypotheses generated by the Attack Hypotheses Generation module. The combination of Attack Hypotheses Generation and Workflows Generation enables intelligent adjustment of workflows, which react to emerging threats effectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
