Hunting Cyber Threats in the Enterprise Using Network Defense Log

As business continues to evolve, the systems that support its functionalities also become more complex and sophisticated. This situation constitutes even more significant cybersecurity threats, heightening business risks that require more security protection for the business systems. Firewall, Intrusion Detection System (IDS) and Web Application Firewall have been utilized extensively to counter these threats at the perimeter between the Internet and internal systems. Unfortunately, these security perimeter devices failed to detect new unknown threats due to their reliance on signature-based methods. This research proposes a framework that employs threat hunting that utilizes the security device log and network forensics to uncover the unknown threats and validate the results using memory forensics. New rules created from this discovery will allow the protection at the border to be more dynamic and effective in handling previously unknown security threats.