Computer networks are an integral part of our society and functioning without them is difficult, as computers rely on this connection for their data or shared computing power. While this connectivity is often beneficial, it has downsides as well. A malicious actor can try to break into a network remotely, which organisations try to prevent by monitoring their networks in order to detect such an attacker. Monitoring can be done, for example, by searching for Indicators of Compromise (IoC) within the network traffic. These IoC can take the form of a single attribute, such as an IP address, or a combination of multiple attributes, such as an IP address, a protocol and a domain name. If during this search IoC match with the network data, a malicious actor might be present in the network. An in-house solution is not feasible for all organisations as this would result in more financial overhead, thus a managed Security Operations Center (mSOC) can be contracted. Often, such an mSOC has access to all network data in order to match their IoC. However, this may be undesirable for organisations that want to keep their sensitive network data as private as possible. Therefore, sharing relevant data only when a match has been found is preferable. Additionally, an mSOC has reasons to want to keep their IoC private as well, as they invest resources into gathering these IoC and sharing them would pose a risk to their business model. In this work we aim to match IoC, consisting of a variable number of attributes, with network data in order to retrieve data associated with matches while preserving the confidentiality of the unmatched data of both the mSOC and the organisation. While there exist privacy-preserving solutions that can aid in parts of this problem, no solution yet exists, to the best of our knowledge, that efficiently solves the problem entirely with our constraints on confidentiality.

To this end, we propose two privacy-preserving protocols that enable exact matching of variable multi-attribute IoC and network data. For both protocols, we analyse the theoretical complexity and test proofs of concept in order to highlight their strengths and weaknesses.