Helping hands: Measuring the impact of a large threat intelligence sharing community
Xander Bouwman, Victor Le Pochat, Pawel Foremski, Tom Van Goethem, Carlos H. Gañán, Giovane C. M. Moura, Samaneh Tajalizadehkhoob, Wouter Joosen, Michel van Eeten
Presented at 31st USENIX Security Symposium (USENIX Security 2022)
We tracked the largest volunteer security information sharing community known to date: the COVID-19 Cyber Threat Coalition, with over 4,000 members. This enabled us to address long-standing questions on threat information sharing. First, does collaboration at scale lead to better coverage? And second, does making threat data freely available improve the ability of defenders to act? We found that the CTC mostly aggregated existing industry sources of threat information. User-submitted domains often did not make it to the CTC's blocklist as a result of the high threshold posed by its automated quality assurance using VirusTotal. Although this ensured a low false positive rate, it also caused the focus of the blocklist to drift away from domains related to COVID-19 (1.4%-3.6%) to more generic abuse, such as phishing, for which established mitigation mechanisms already exist. However, in the slice of data that was related to COVID-19, we found promising evidence of the added value of a community like the CTC: just 25.1% of these domains were known to existing abuse detection infrastructures at time of listing, as compared to 58.4% of domains on the overall blocklist. From the unique experiment that the CTC represented, we draw three lessons for future threat data sharing initiatives.
BibTeX:
@inproceedings{Bouwman2022HelpingHands,
author = {Bouwman, Xander and Le Pochat, Victor and Foremski, Pawel and Van Goethem, Tom and Gañán, Carlos H. and Moura, Giovane C. M. and Tajalizadehkhoob, Samaneh and Joosen, Wouter and van Eeten, Michel},
title = {Helping hands: Measuring the impact of a large threat intelligence sharing community},
booktitle = {31st USENIX Security Symposium},
series = {USENIX Security '22},
year = 2022,
pages = {1149--1165}
}