The Internet connects organizations across finance, government, education, and other sectors, forming a global network of interdependent systems. Although this connectivity enables organizations to provide services, coordinate operations, and communicate with external users, it a
...
The Internet connects organizations across finance, government, education, and other sectors, forming a global network of interdependent systems. Although this connectivity enables organizations to provide services, coordinate operations, and communicate with external users, it also increases their exposure to cyber attackers. Attackers exploit connected networks for financial gain, political objectives, or operational disruption, while often hiding their identity through distributed infrastructure such as botnets. These botnets are obtained either by renting existing infrastructure or by manually compromising large numbers of computers. To maximize the value of this infrastructure, attackers reuse the same botnets across multiple targets within a single campaign. Consequently, organizations in the same industry sector, which often expose similar network protocols and services, face related malicious activity from the same attacker-controlled infrastructure.
To defend themselves against such attackers, organizations deploy intrusion detection systems (IDSs). An IDS continuously monitors the incoming and outgoing network traffic, typically represented as packets, and inspects this traffic for signs of malicious behavior. IDSs commonly rely on two primary detection methods. Signature-based detection checks whether the packets match known attack signatures. Anomaly-based detection identifies traffic that deviates from expected or normal network behavior. Together, these methods help organizations detect known attacks, unusual behavior, and suspicious traffic patterns within their own networks.
Although individual IDS deployments provide network defenses, attackers exploit the limitations of local detection. For example, signature-based detection fails when attackers use evasion techniques such as packet fragmentation, where malicious traffic is split into multiple smaller packets that appear harmless when inspected separately. More broadly, a single IDS observes only the traffic directed at its own network. As a result, it sees suspicious activity as isolated local events and lacks the wider context needed to determine whether the same attacker infrastructure is targeting other organizations. Therefore, an IDS alone is not sufficient to identify broader attack campaigns that span multiple networks.
The inability of individual organizations to observe campaign-level activity creates a need for greater cross-organizational visibility. When the same attacker-controlled infrastructure targets organizations in the same sector, shared patterns appear across their network logs. Correlating these observations helps organizations determine whether suspicious activity is isolated or part of a coordinated campaign. However, obtaining such visibility requires multiple organizations to compare information derived from their logs. Directly sharing raw network logs is impractical because logs contain sensitive information, including credentials, internal IP addresses, authentication data, proprietary operational details, and other organization-sensitive information.
The hesitation in sharing raw network logs creates the need for a computational framework that enables secure correlation between organizations. Private Set Intersection (PSI) provides a cryptographic basis for this capability by allowing parties to compute common elements across private sets without revealing non-matching elements. PSI has been extensively studied and has been extended to Multi-party Private Set Intersection (MPSI), which supports n participants. A relevant variant for collaborative threat intelligence is Threshold MPSI, where an element is reported if it appears in at least t out of n private sets. In this thesis, the proposed TMPSI-based solution determines whether a suspicious IP address appears in a threshold number of organizations' network logs and alerts the participating organizations to possible coordinated attack activity. Organizations that have not yet observed the same activity can use the threshold result to proactively strengthen their defenses. In this way, the proposed framework transforms isolated IDS deployments into a collaborative threat intelligence system that preserves privacy, revealing attack campaigns that remain hidden from individual organizations while preserving the confidentiality of local network logs.