Building STINGAR to enable large scale data sharing in near real-time

No ratings

Presented at FIRSTCyberThreatIntelligenceSymposium 2019 by

Jesse Bowling

Duke University has embarked on a multi-year mission to help lower the difficulty on automated threat intelligence sharing across higher education institutions under the umbrella project STINGAR (Shared Threat Intelligence for Network Gatekeeping and Automated Response). The overarching goals of STINGAR are to enable organizations (especially higher education) across a wide range of technical, operational maturity, and budget resources to collect, analyze, action, and share threat intelligence.Duke began moving to an “active defense” or “automated response” model for blocking attackers in 2014. Around this same time, we began exploring the use of honeypots for detecting attackers, and found that honeypots provided a very effective way to identify external attackers of common services quickly with low false positive rates. We quickly realized that the data we generated locally could easily be shared to others, and we began making our data available to other schools and organizations.Based on our experiences, Duke created the STINGAR project with the goals of:Simple, low-friction deployment of intelligence collection sensors (honeypots initially)Central collection of intelligence from sensors and outside sources, for analysisSimple methods for sharing data to peersA variety of methods and guidance for feeding threat intelligence to protection devicesIn this presentation we will provide additional background and details on Duke’s experiences with integrating threat intelligence into the overall security program, discuss existing and future features of the CHN system, models of data sharing, and evaluation methods and metrics on effectiveness. We hope to encourage discussion around the general approach, as well as discussions on how others are generating and using threat intelligence, with the hope of identifying new ways that the data we’re collecting can be shared with the community for the benefit of defenders.