Summiting the Pyramid

Project Summary

Published : Sep 10, 2023

Many analytics are dependent on specific tools or artifacts. Adversaries can easily evade these with low-cost changes that exploit the dependencies. This project developed a method to evaluate analytics relative to the adversary’s cost to evade. We further created approaches and tips for defenders to make their analytics less evadable. We demonstrated the methodology with a core set of analytics.

Problem

Adversaries can easily evade cyber analytics that are dependent on specific tools or artifacts.

SOLUTION

Create and apply a methodology to evaluate the dependencies inside analytics and make them more robust by focusing on adversary behaviors.

IMPACT

Shift the advantage towards defenders with improved analytics that catch adversaries even as they evolve and detect future campaigns.

funding Research Participants

Leadership Spotlight: 
Collaborative Leadership Driving Innovation

 

Hear directly from research participants about this project and why it matters. Learn how these leaders are changing the game on the adversary.

Share This Project

Stay Informed

Stay informed about new releases of R&D projects and other exciting updates from the Center for Threat-Informed Defense.