Software Engineering Institute | Carnegie Mellon University
Software Engineering Institute | Carnegie Mellon University

Digital Library

Javascript is currently disabled for your browser. For an optimal search experience, please enable javascript.

Advanced Search

Basic Search

Content Type

Topics

Publication Date

Conference Paper

A Notation for Describing the Steps in Indicator Expansion

  • September 2013
  • By Jonathan Spring
  • In this paper, Jonathan Spring proposes a method of capturing the process of indicator expansion in a deterministic yet flexible and extensible manner.
  • Network Situational Awareness
  • Publisher: Software Engineering Institute
  • Abstract

    Indicator expansion is a process of using one or more data sources to obtain more indicators of malicious activity by identifying those related to currently known indicators. Due to the many variables in how the process is carried out, it quickly becomes difficult to capture the process that leads to an expanded set of data. Keeping track of this process is important for description to other analysts. A compact description of the process is even necessary just for the analysts doing the work to keep track of their own process and which paths have been investigated, particularly in naming files.

    This paper, presented at the IEEE/APWG eCrime Researcher Summit in 2013, proposes a method of succinctly capturing the process of indicator expansion in a deterministic yet flexible and extensible manner. The target audience is analysts and investigators engaged in indicator expansion or directly consuming results therefrom.

  • Download