Collaborative Information Sharing for ML-Based Threat Detection

TL;DR

This paper explores how sharing specific information across networks can enhance machine learning-based threat detection, especially against coordinated and evasive malware attacks, by proposing and evaluating three sharing methods.

Contribution

It introduces three novel information sharing methods tailored for multi-network environments to improve ML-based threat detection against coordinated attacks.

Findings

Shared information significantly improves malware detection accuracy.

Proposed methods outperform existing threat sharing approaches.

Enhanced detection reduces false negatives in threat identification.

Abstract

Recently, coordinated attack campaigns started to become more widespread on the Internet. In May 2017, WannaCry infected more than 300,000 machines in 150 countries in a few days and had a large impact on critical infrastructure. Existing threat sharing platforms cannot easily adapt to emerging attack patterns. At the same time, enterprises started to adopt machine learning-based threat detection tools in their local networks. In this paper, we pose the question: \emph{What information can defenders share across multiple networks to help machine learning-based threat detection adapt to new coordinated attacks?} We propose three information sharing methods across two networks, and show how the shared information can be used in a machine-learning network-traffic model to significantly improve its ability of detecting evasive self-propagating malware.