Reproduce “Evidential Cyber Threat Hunting” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Frederico Araujo, Dhilung Kirat, Xiaokui Shu, Teryl Taylor, Jiyong Jang
Evidential Cyber Threat Hunting presents a formal framework for turning threat hunting into an iterative reasoning process over heterogeneous evidence, competing hypotheses, and defensive actions. Its domain-specific language and runtime demonstrate how a low-level beaconing signal can be traced into a verified multi-host Zeus campaign and used to rank containment, quarantine, deception, fortification, and information-sharing responses, although large-scale empirical effectiveness is not yet evaluated.
Key insights
- Low-level observations need not identify a complete attack: detectors can generate multiple candidate explanations that are refined through case manifolds and verifiers.
- Verified hypotheses are fed back into the knowledge base, allowing one investigation to support later impact analysis and campaign reconstruction.
- Response selection is state-dependent and can include proactive measures such as decoys and fortification alongside containment and quarantine.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.