6th European Conference - Academic Conferences

David Merritt and Barry Mullins
to the probability of cyber espionage, it is possible to use this score to measure the probability of the
entire event as being cyber espionage.
It is important to note that an individual event detected by itself may not express outright if a
circumstance is cyber espionage-related or not. A targeted, socially-engineered intrusion might be a
sophisticated spam or phishing attempt. New and undetected information-stealing malware could be a
new variant of benign adware. A consistent transfer of significant amounts of encrypted data could
end up being an authorized VPN (virtual private network) connection. The subtlety of a covert channel
may be difficult to detect or declare with certainty its intentions, but it does serve as an impetus to
investigate further to determine the context of the channel.
The advantage behind this synthesis approach is that intrusion, malware, or exfiltration detection can
be viewed within the context of the whole event. Not doing so could lead to incorrect conclusions
being drawn from insufficient context. But each step of a cyber spy's attack methodology is not of
equal value to the investigator. For instance, it is a challenge to judge the intent of malware simply by
looking at its detectability and functionality. Many malicious programs have the same functionality but
are used for different purposes. In fact, many legitimate programs are frequently used maliciously
(e.g., Remote Administration Tools). On the contrary, a targeted intrusion that is industry-relevant
hints at the intentions of the adversary—to quietly get to specific targets. Thus, the intrusion factor
should be weighted more than the malware “factor”. Similarly, with data exfiltration detection,
covertness of the channel and sensitivity of the data are significant factors affecting the
characterization of espionage. These factors' weights should have more weight than the malware
installation factor.
This strategic weighting of indicators is integrated to establish the Espionage Probability Matrix (EPM)
framework, shown in Table 1. The EPM is used to determine an EPM score based on varying degrees
of espionage probability, as indicated by the three columns of High, Medium, and Low Probability.
Each indicator is assigned a value associated with its column, with High, Medium, and Low indicators
being assigned values of 3, 2, and 1, respectively. The values for the indicators (e.g., targeted and
tailored network intrusion) within each factor (e.g., Intrusion) are averaged to provide an EPM score
for that factor. For example, a network intrusion that is not targeted at a specific user/group but
contains somewhat tailored content results in an Intrusion factor EPM score of 1.5. This is calculated
by averaging the “Not targeted” indicator (i.e., 1) with the “Potentially tailored” indicator (i.e., 2).
Table 1: Espionage Probability Matrix (EPM)
Intrusion
Malware
Exfiltration
High Probability Medium Probability Low Probability
Targeted; specific victims
Tailored; social engineering
required
Novel or unknown
Advanced info/data- stealer
Covert channel
Custom encryption
Significant data transfer
Industry-specific
Potentially targeted
Potentially tailored; social
engineering may be used
Not well known; variant of
known
Info/data- stealer
Attempts to hide channel
Standard encryption
Non-trivial data transfer
Partially industry-specific
Not targeted
Well-known methods
Well known
Not info/data-stealer
No attempt to hide channel
Not encrypted
Negligible data transfer
Not industry-specific
The Intrusion row has a α multiplier, where α > 1, to represent the relative importance of intrusion
classification to the overall EPM score. The Exfiltration row has a β multiplier, where β > 1, to
represent the relative importance of data exfiltration classification to the overall EPM score. This
effectively assigns greater importance to the factors that deserve it, as discussed. These individual
probabilities are brought into context of the entire event by calculating an overall EPM score using the
following equation:
EPM Score = α·Intrusion + Malware + β·Exfiltration
184