Hypothesis Generation Model for Cyber Threat Hunting

Cyber attackers are rapidly developing their attack tactics and techniques, and their threats already pose a great danger to the world. Using cyber threat intelligence, security analysts make attack reconstruction possible, and human analysts are mainly responsible for the analysis of security system alerts. A cyber threat hunting hypothesis typically addresses the type of threat being hunted and how it is discovered. In this study, we propose a five-step hypothesis generation model for cyber threat hunting. The proposed model leverages proactive indicators of attack (IOAs) and information technology (IT) asset information related to network security, and correlates them with indicators of compromise (IOCs), defines the structure of hypothesis, and presents the attack domains-based hypothesis generation method for the formation of complicated hypotheses. In addition, it provides an approach to prioritizing the hypotheses.