DomainPrio

Prioritizing Domain Name Investigations to Improve SOC Efficiency

Journal Article (2022)
Author(s)

Daiki Chiba (NTT Corporation)

Mitsuaki Akiyama (NTT Corporation)

Yuto Otsuki (NTT Corporation)

Hiroki Hada (NTT Corporation)

Takeshi Yagi (NTT Corporation)

Tobias Fiebig (Max Planck Institut für Informatik)

M.J.G. van Eeten (TU Delft - Organisation & Governance)

Department
Multi Actor Systems
Copyright
© 2022 Daiki Chiba, Mitsuaki Akiyama, Yuto Otsuki, Hiroki Hada, Takeshi Yagi, Tobias Fiebig, M.J.G. van Eeten
DOI related publication
https://doi.org/10.1109/ACCESS.2022.3161636
More Info
expand_more
Publication Year
2022
Language
English
Copyright
© 2022 Daiki Chiba, Mitsuaki Akiyama, Yuto Otsuki, Hiroki Hada, Takeshi Yagi, Tobias Fiebig, M.J.G. van Eeten
Department
Multi Actor Systems
Volume number
10
Pages (from-to)
34352-34368
Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Abstract

Security Operations Centers (SOCs) are in need of automation for triaging alerts. Current approaches focus on analyzing and enriching individual alerts. We take a different approach and analyze the population of alerts. In an observational study over 24 weeks, we find a surprising pattern: some domains get analyzed again and again by different analysts, without coming to a final evaluation. Overall, 19% of the domains trigger 74% of all investigations. The most time-consuming domains are classified as false positives and 'potentially unwanted programs' - the lowest threat level. To increase SOC efficiency, we design DomainPrio, a tool that prioritizes domains that are likely to be the subject of repeated, incomplete investigations. This enables us to indicate to the first analyst encountering this domain that the investigation should be, if possible, completed on this first attempt, so future investigations on the same domain can be prevented. DomainPrio is able to predict these domains with 89% accuracy and does so with an interpretable and auditable logistic regression model. When evaluating our tool on 100 days of data from a production setting, we find that it can potentially reduce the number of alert investigations by up to 35%, presenting the SOC with very substantial efficiency gains.