DomainPrio

DomainPrio: Prioritizing Domain Name Investigations to Improve SOC Efficiency

Chiba, Daiki (NTT Corporation)
Akiyama, Mitsuaki (NTT Corporation)
Otsuki, Yuto (NTT Corporation)
Hada, Hiroki (NTT Corporation)
Yagi, Takeshi (NTT Corporation)
Fiebig, Tobias (Max Planck Institut für Informatik)
van Eeten, M.J.G. (TU Delft Organisation & Governance)

2022

Security Operations Centers (SOCs) are in need of automation for triaging alerts. Current approaches focus on analyzing and enriching individual alerts. We take a different approach and analyze the population of alerts. In an observational study over 24 weeks, we find a surprising pattern: some domains get analyzed again and again by different analysts, without coming to a final evaluation. Overall, 19% of the domains trigger 74% of all investigations. The most time-consuming domains are classified as false positives and 'potentially unwanted programs' - the lowest threat level. To increase SOC efficiency, we design DomainPrio, a tool that prioritizes domains that are likely to be the subject of repeated, incomplete investigations. This enables us to indicate to the first analyst encountering this domain that the investigation should be, if possible, completed on this first attempt, so future investigations on the same domain can be prevented. DomainPrio is able to predict these domains with 89% accuracy and does so with an interpretable and auditable logistic regression model. When evaluating our tool on 100 days of data from a production setting, we find that it can potentially reduce the number of alert investigations by up to 35%, presenting the SOC with very substantial efficiency gains.

Network security
security operations
security operations centers
SOC
threat analysis

http://resolver.tudelft.nl/uuid:6285459c-b93c-4dd1-91ab-388eda2ff378

https://doi.org/10.1109/ACCESS.2022.3161636

2169-3536

IEEE Access, 10, 34352-34368

Institutional Repository

journal article

© 2022 Daiki Chiba, Mitsuaki Akiyama, Yuto Otsuki, Hiroki Hada, Takeshi Yagi, Tobias Fiebig, M.J.G. van Eeten