OwlSight: Platform for Real-time Detection and Visualization of Cyber Threats

• Autor(a) principal: Carvalho, Vasco Samuel
• Data de Publicação: 2016
• Outros Autores: Polidoro, Maria João, Magalhães, João Paulo
• Tipo de documento: Artigo
• Idioma: eng
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/10400.22/10105
• topic: cybersecurity; threat intelligence; big data security; big data visualization; malware

ecurity reports published by leading companies reveal the growing number of cyber attacks. Thefts of money or sensitive data, harm the reputation of organizations and sabotage of national critical infrastructures are some of the motivations behind these attacks. The sophistication of these attacks is very high, creating major challenges to the detection and mitigation in useful time. In this context the development of systems to provide situational awareness, to detect cyber threats and alert them in real-time are very important to mitigate the impact of the attacks. In this paper we present a cyber threat platform targeted for real-time detection and visualization of cyber threats. The platform is composed by several building blocks and it is able to collect huge amounts of data from multiple sources, prepare and analyze the data and present the findings through a set of insightful dashboards. A version of the platform is already available and used in a real-context. It collects more than 107 million of malware events daily from different data sources and provides visualization and alerts in real-time for more than 2.7 million of infected unique IPs spread around the world.