A Trusted Knowledge Management System for Multi-layer Threat Analysis

Abstract

In recent years, we have seen a surge of cybersecurity incidents ranging fromwidespread attacks (e.g., large-scale attacks against infrastructures or end points [1]) to new technological advances (i.e., new generations of malicious code are increasingly stealthy, powerful and pervasive [2]). Facing these incidents, the European Union, Japan, the United States or China have developed national cybersecurity programs, including training of professionals, development of roadmaps for new tools and services, and organization of national interest groups on the topic. There is thus a shared need for a better understanding of this kind of large-scale threats. Some of the basic requirements to better understand these large-scale incidents include handling large volumes of data collected from distributed probes and performing efficient cross-layer analysis.