Use Case: Support malicious cyber activity detection

Abstraction Level: High

Related Use Cases

Description

Supporting the detection of various forms of malicious activity (e.g., malware, DDOS attacks, etc.) through the use of structured cyber data such as IP addresses is fundamental to the notion of indicator sharing and incident response (when followed by detection). In its most basic form, it means being able to characterize cyber data and also specify a pattern around it, to signify "what" to look for.

Requirements

1. The ability to characterize various types of cyber data
2. The ability to specify patterns atomic cyber data

Applicable Domains

• Indicator sharing
• Incident response