Privacy aware sharing of IOCs in MISP

Details

Supervisors

Sadre, Ramin

Faculty

Ecole polytechnique de Louvain

Degree label

Master [120] : ingénieur civil en informatique

Abstract

Malwares are plaguing this computer age. An actual solution to protect computer systems against them is threat information sharing: Organisations share lists of Indicators Of Compromise with each other. For that, an interesting open source platform called MISP allows organisations to share these IOCs but also malware analyses and attack correlations in an online fashion. On the other hand, offline lookups would also be an important feature but is stopped by the need of data privacy and confidentiality. This master thesis looks for sharing the MISP dataset of IOCs allowing later offline lookups while still protecting privacy and confidentiality by not directly disclosing the information. After a review of the state of the art, a possible found solution has been implemented with some improvements before finally being analysed.