Operable Subjective Logic Analysis Technology for Intelligence in Cybersecurity

Oslo Analytics var et forskningsprosjekt innen cybersikkerhet ved Universitetet i Oslo. Prosjektet fokuserte på å utvikle ny teknologi for automatisert deteksjon, prediksjon og forebygging av cyberangrep. For eksempel forsket prosjektet på kunstig intelligens for situasjonsforståelse ved cyberangrep. Gitt at cybertrusler er i stadig er i endring må verktøy for cybersikkerhet være fleksible og kunne ta ibruk nye avanserte metoder for opprettholde et effektivt forsvar. Digital trusseletterretning (CTI), maskinlæring, og tillitsberegning er eksempler på metoder som ble brukt. Samarbeidspartnerne i Oslo Analytics var bl.a. mnemonic som er en sentral industriaktør innen cybersikkerhet, og Norsk Regnesentral som har spisskompetanse innen datavitenskap og maskinlæring. Samarbeidet dannet et sterkt miljø for fremragende forskning i cybersikkerhet ved Universitetet i Oslo. De siste forskningsresultatene av Oslo Analytics var deltakelsen i OASIS for standardisering av CTI (Cyber Threat Intelligence) med UiO i sentrale roller, og integrasjonen av maskinlæring-teknikker i praktisk trusselmodellering hos mnemonic.

Oslo Analytics has contributed in a very significant way to global standardisation of CTI by being member of OASIS, where the major players in the industry meet. Produced standards are Open C2 (Command and Control), TAC (Threat Actor Context), and new version of STIX (Structured Threat Information eXpression). Automatic detection of domain-generation algorithms based on ML (Machine Learning) was developed. This technology has already attracted substantial attention in the cyber-security community, and has been successfully integrated in the professional cyber-intelligence tools used by Mnenmonic. This rapid uptake of research outcomes from the Oslo Analytics project for professional cybersecurity technology reflects very high quality of research. The work on Bayesian network models based on subjective logic is being adopted by industry around the world. The Australian company Veriluma produces intelligence analytics tools for military and law enforcement agencies.

Oslo Analytics aims at investigating and developing technology for automated cyberattack detection, prediction and prevention coupled with situational intelligence analysis. More specifically the project will build and validate innovative cybersecurity intelligence technology based on statistical analysis of security data as well as on subjective Bayesian networks for intelligence analysis. Given that modern cyberattacks are rapidly changing and are becoming increasingly stealthy and deceptive, cybersecurity tools must be sufficiently flexible and adaptable to this trend in order to be of any value. Oslo Analytics takes the approach that cybersecurity tools must be enhanced with advanced intelligence analysis capabilities to be able to meet these criteria. This type of tools will make government and private security agencies more potent against cybercrime in a world of rapidly changing security threats. Oslo Analytics brings together an international consortium of organisations with deep and solid expertise in their fields which have the capacity to produce valuable deliverables and, through their collaboration, create a strong community for excellence in cybersecurity intelligence.