cid 60ff417c8b2c36d0b1eb42770b1f433555f7dc57a225921317c362d48f4407c7 · original · open access · via openalex
Title: Performance Evaluation of Open-Source Endpoint Detection and Response Combining Google Rapid Response and Osquery for Threat Detection Authors: So‐Hyun Park; Sun-Woo Yun; So-Eun Jeon; Na-Eun Park; Hye-Yeon Shim; Yu-Rim Lee; Sun-Jin Lee; Tae-Rim Park; Na-Yeon Shin; Min-Jin Kang; Il-Gu Lee Venue: IEEE Access Year: 2022 Canonical: doi:10.1109/access.2022.3152574 URL: https://doi.org/10.1109/access.2022.3152574 Collector: openalex OA: true ABSTRACT Detecting the latest advanced persistent threats (APTs) using conventional information protection systems is a challenging task. Although various systems have been employed to detect such attacks, they are limited by their respective operating systems. Furthermore, they are developed as closed platforms and cannot be customized to meet user environments. To overcome these limitations, open-source endpoint detection and response (EDR) techniques are needed. In this study, we construct one that integrates open-source security frameworks combining GRR (Google Rapid Response) and osquery. A threat-detecting case study is conducted to validate the feasibility of the proposed open-source EDR system. Additionally, APT coverage for the proposed EDR system is analyzed using MITRE’s Adversarial Tactics, Techniques, and Common Knowledge model. The assessment result shows that APT tactics having high levels of threat detection using non-customized osquery configurations comprise 28.5 % of all detections, which is lower than the other response levels. The performance of open-source EDR can be increased by customizing osquery for specific purposes and environments. Open-source EDR combining GRR and osquery has the potential to provide the detection-coverage efficient threat detection system and has the advantage of flexible integration with other applications; it can also be developed for evolving system environments such as cloud and internet of things.