Summiting the Pyramid v1

September 10, 2023

Project Summary

Many analytics are dependent on specific tools or artifacts. Adversaries can easily evade these with low-cost changes that exploit the dependencies. This project developed a method to evaluate analytics relative to the adversary’s cost to evade. We further created approaches and tips for defenders to make their analytics less evadable. We demonstrated the methodology with a core set of analytics.

Problem

Adversaries can easily evade cyber analytics that are dependent on specific tools or artifacts.

Solution

Create and apply a methodology to evaluate the dependencies inside analytics and make them more robust by focusing on adversary behaviors.

Impact

Shift the advantage towards defenders with improved analytics that catch adversaries even as they evolve and detect future campaigns.

Project Resources:

Project Announcement Project Website GitHub

---

Funding Research Participants

---