大数据驱动的威胁预测实战指南：Sygness《威胁预警》解析

需积分: 10 19 浏览量更新于2024-07-19 收藏 9.76MB PDF 举报

《威胁预测：利用大数据进行预测分析》是一本由Sygness出版的专业书籍，它针对IT安全领域的重要课题进行了深入探讨。作者John Pirc、David Desanto、Ian Davison和Will Gragido结合多年实践经验，通过丰富的实例和详细的案例研究，引领读者进入威胁预测的世界。书中核心内容围绕大数据在威胁预测中的应用展开： 1. **历史数据的价值**：书中强调了使用历史数据进行预测分析的重要性，通过对过往违规行为的分析，帮助组织识别潜在的风险模式，从而预测未来的威胁情况。 2. **安全情报的作用**：安全情报是构建威胁预测技术的关键工具。作者讲解了如何有效整合和利用这些信息，以便更准确地预测威胁动态，提升预警能力。 3. **威胁数据可视化技术**：通过可视化手段，读者可以更好地理解和解读大量的威胁数据，使得复杂的数据变得直观易懂，有助于快速识别关键趋势和异常行为。 4. **威胁模拟工具**：书中介绍了一种实用方法，即通过模拟工具对可能的威胁场景进行演练，帮助组织评估应对策略的有效性，并预先规划响应措施。 5. **非结构化大数据安全洞察**：随着大数据的增长，如何处理和分析非结构化的威胁数据，如社交媒体和网络日志，成为关注焦点。这本书提供了宝贵的指导，教给读者如何从中提取有价值的信息。 6. **风险降低策略**：通过深入理解威胁预测，读者将学到一套系统性的策略，如何利用大数据降低组织面临的风险，实现安全管理的优化。 7. **版权与许可**：本书享有严格的版权保护，任何复制或传播行为必须得到出版社的书面许可。关于版权政策和获取更多信息，读者可访问Elsevier的官方网站。《威胁预测：利用大数据进行预测分析》是一本实用的指南，对于IT安全专业人员、企业管理人员以及对大数据驱动的安全预测感兴趣的读者来说，它提供了宝贵的知识和实践技巧，帮助他们在日益复杂的网络环境中保护组织免受威胁。

PREFACE

Man has endeavored to see beyond his circumstances since

time immemorial. He has developed and adop ted a vast and wide

array of esoteric beliefs and rituals, which, over time, aided him to

one degree or another in making decisions that would have ram-

ifications on individuals, communities, populations, and empires.

Throughout history, man’s desire to know and understand the

future has encouraged him to strive toward greater and greater

heights; heights that could only be reached by dismissing the eso-

teric in favor of the scientific. Today, man continues to forecast

and predict outcomes, only now instead of looking into the mists

or at the bones, man looks at evidence; at math and contemplates

probability based on a variety of factors all of which can be

explained through science and articulated in such a way that

the everyone can understand. This book deals with an area that

is emerging. It is growing and developing, and is being nurtured

by a portion of the Information Security industry, that in some

ways is at a pivot point, where it is destined to move from the

modern equivalent of esotericism to the new reality. In this book

the concept of threat forecasting and predictive analysis is intro-

duced to the reader in a manner that is easy to understand and

digestible. It is delivered in 10 chapters all of which have been

written and contributed to by the industry’s leading subject mat-

ter experts with combined experience that can be measured in

decades. This book will challenge some to look beyond the mist

and embrace the scientific; the tangible. It will encourage the

reader to think differently with respect to navi gating and negoti-

ating today’s threats, threat forecasting, security intelligence and

the threat landscape itself.

Book Organization and Structure

During the following ten chapters the reader will be exposed to

concepts and ideas that they may have considered but never

employed or to those that are entirely new. Each chapter offers

a unique view of our experiences and thoughts. The book is bro-

ken down in the following manner:

Chapter 1: Navigating Today’s Threat Landscape—We start by

discussing the issues within today’s threat landscape and show

the need for a better solution. A high-level discussion around

industry regulations will help set the tone for why threat forecast-

ing is needed. We finish this chapter by challenging today’s infor-

mation assurance practices.

Chapter 2: Threat Forecasting—We discuss the foundations of

threat forecasting and compare patterns used to other types of

forecasting you may be familiar with. This chapter will also lay

some of the foundations for future chapters, including a discus-

sion around big data and its importance within threat forecasting.

Chapter 3: Security Intelligence—We will introduce you to secu-

rity intelligence and help structure what a security intelligence

platform should look like for your organiz ation. This chapter will

also discuss key performance indicators that are commonly asso-

ciated with security intelligence.

Chapter 4: Identifying Knowledge Elements—We define key

terms that may be new to the reader including Indicators of Com-

promise (IOCs) and Indicators of Interest (IOIs). We help identify

some issues when collecting knowledge elements and help pro-

vide guidance on how to address them to get the best data possible

for knowledge sharing and threat modeling.

Chapter 5: Knowledge Sharing and Community Support—The

advantages and disadvantages to sharing knowledge elements are

discussed and we reassure the reader that it is best to share and

gain knowledge than be left in the dark. We outline several popular

community threat intelligence feeds and how to become active

within the threat intelligence community.

Chapter 6: Data Visualization—We use this chapter to outline

the different ways to visualize your data for analysis and simula-

tion. Three-dimensional graphs are reviewed and comparisons

are drawn to other industries that leverage similar technologies.

Visualization is a key component on the road to threat forecasting.

Chapter 7: Data Simulation—In this chapter we discuss several

topics as they relate to data simulation. These include compari-

sons between simulation and emulation, the importance of deal-

ing with knowledge elements (discussed in Chapter 4) and the

types of engines available today. Future topics are discussed

including leveraging quantum computing for faster data results.

Chapter 8: Kill Chain Modeling—We define kill chain modeling

and discuss how it associates with threat forecasting. We dissect

the individual components to help you better understand its

necessity within this type of threat modeling. We discuss the role

of big data as well as the tools available today to assist with kill

chain modeling.

Chapter 9 : Connecting The Dots—We bring together all the

individual topics discussed throughout the book and show how

xvi PREFACE

ACKNOWLEDGMENTS

The journey of a thousand miles begins with one step

Lao Tzu

I want to dedicate this book to my Lord and Savior Jesus Christ,

my wife, kids, and my mom (Judy Pirc)…I love you all. After writ-

ing two books, I didn’t think I would ever do a third. I’ve had the

pleasure to be involved in both early stage startups and well-

established high-tech security companies. I’ve been honored to

have influenced various security products working with some very

strong teams. The experience has provided me with many oppor-

tunities to experience what works and frankly what doesn’t. To

some this concept of Threat Forecasting that I envisioned almost

4 years ago, some of the parts of which might be considered main-

stream/bleeding edge security products and services, today might

appear an impossible or a crazy idea.

On this journey, I quickly realized that I couldn’t take on this

project by myself and needed some of the best minds, with exper-

tise in threat intelligence, hardware design, data science, data

modeling, virtualization, SaaS, and product development; people

whom I trusted to participate, to add to the project and to chal-

lenge me. I decided to involve David DeSanto, Iain Davison,

and Will Gragido all of whom I trust and respect, as they are

not afraid of giving brutally honest feedback and it doesn’t hurt

that they are close friends. After I briefed them on the original con-

cept…let’s say some of my theories were challenged and they

pushed me to a level of innovation that I had thought wa s beyond

my capabilities. I’m very proud of their contributions and thought

leadership in Threat Forecasting.

Lastly, I want to thank a few people that have been instrumen-

tal in my career, Stephen Northcutt, Bob Bigman, John Webster,

John Watkins, Greg Adams, Alan Kessler, Heath Peyton, John Law-

rence, Ernest Rocha, Frank Oakes, Chris Morales, Dan Holden,

Daniel J. Molina, Dan Seeley, Brendan Laws, Craig Lawson, Steve

MacDonald, Scott Lupfer, Jacque Kernot, Brian Reed, Jason

Lamar, Rees Johnson, Vik Phatak, Bob Walder, ReseAnne Sims,

Kris Lamb, Eric York, David Poarch, Chris Becker, Lance Grover,

Rich Raines, Andria Green, Chad Randolph, Mark Dowd, George

V. Hulme, Ofir Zelnik, Donovan Kolbly, Gary Steely, Dillon Beres-

ford, Ragy Magdy, Melanie Kesler Coppen, Mark Finke, Melinda

xix

剩余189页未读，继续阅读

csdn_user01

粉丝: 14
资源: 40

大数据驱动的威胁预测实战指南：Sygness《威胁预警》解析

matlab时间序列分析工具程序

用MATLAB实现对周期趋向性物流需求的快速预测

ARIMA时间序列预测的matlab实现

人工智能可以应用在哪些网络安全技术中？请对其中一个技术作详细分析

UTM（统一威胁管理 United Threat Management）

将威胁“重心”的坐标精确到个位，利用标准粒子群算法对极值进行搜索得到集群威胁“重心”在惯性坐标系OXYZ下的坐标的matlab仿真代码

微软威胁建模模型STRIDE怎么在实际中运用

threat hunting. capability

全流量分析系统 apt tar

threat intelligence

最新资源