Implementation of Cyber Threat Intelligence on Intrusion Detection System using STIX Framework

Abstract

Cyber threats are complex and diverse issues. Various types of threats emerge daily on the internet. In this research, we proposed a new Cyber Threat Intelligence platform to deal with the challenges above, using Snort as a tool for detecting anonymous network traffic and STIX as a serialization format and standardization of Cyber Threat Intelligence data. As a result, a Cyber Threat Intelligence based on Snort contains Apache Spark as the processing engine, MongoDB as the database, and STIX as the serialization format and data standardization. We test our platform by using two data sources, the CIC-IDS2017 dataset, and the real traffic. We successfully converted the snort alerts to STIX format and visualized them into graph. The graph shows indication of network traffic suspicious, the country of attacker come from, attribute information and attack pattern. The experiment shows that converting Snort data to STIX requires considerable time if the amount of data processed is getting bigger, Real Traffic needs 16 seconds of data preprocessing and 3 minutes of conversion time, while PCAP needs 35 seconds of preprocessing time and 13 minutes of conversion time.