Towards information space-based early warning system for enhancing cyber-incident response process

2022 Fiscal Year Annual Research Report

• Project/Area Number: 22F22377
• Allocation Type: Single-year Grants
• Research Institution: Nara Institute of Science and Technology
• Principal Investigator: 門林 雄基 奈良先端科学技術大学院大学, 先端科学技術研究科, 教授 (00294158)
• Co-Investigator(Kenkyū-buntansha): BLUMBERGS BERNHARDS 奈良先端科学技術大学院大学, 先端科学技術研究科, 外国人特別研究員
• Project Period (FY): 2022-11-16 – 2025-03-31
• Keywords: サイバーセキュリティ

Outline of Annual Research Achievements

Within the time period of 2022/12/01 to 2023/03/31, the following project-related tasks and achievements have been accomplished. Drafting the academic publication and conducting a systematic literature review. Definition of the prototype core concepts, underlying technologies and approaches, and definition of the data exchange model. Related technology research and prototype code design and development. Prototype initial development version cloud-based deployment for functionality testing and expansion. The prototype's initial functionality implements various methods for data and meta-data collection from open-source information sources in a unified JSON-based format for platform-independent ingestion for further parsing and data analysis.

Current Status of Research Progress

2: Research has progressed on the whole more than it was originally planned.

Reason

The academic publication drafting and systematic literature review were completed on time as anticipated by the author. The most significant time investment and effort currently has been devoted to learning the required technologies and implementing them into the prototype codebase. The specific nature of the underlying technologies and challenges faced with their implementation in functional code has imposed additional time requirements not initially anticipated. However, it is expected that once the heavy development of the initial prototype version is complete, its further expansion and application for data gathering and analysis should permit a smoother further progression of the project.

Strategy for Future Research Activity

The current short-term direction for project progress is being driven in the following directions. Initial prototype cloud-based deployment, testing, and core functionality completion. Initial dataset collection and validation of the initial project hypothesis Data aggregator and parser development for automated data parsing and historic collected data cross-correlation. A wider scale test against known benign and malignant information sources and collected data parsing. Completion of the initial publication and submission to a conference. From a longer-term perspective - further expansion of the prototype functionality, its automation, and expanded broader tests for data collection and efficiency.