Proactive identification of cybersecurity compromises via the PROID compromise assessment framework.

Area of Science:

• Cybersecurity
• Information Security
• Computer Science

Background:

• Advanced adversarial techniques evade traditional continuous monitoring, leading to prolonged attacker concealment.
• Organizations face long detection times (average >6 months) for security compromises, often discovered by third parties.
• Current Compromise Assessment (CA) practices are fragmented, lack standardization, and are often confused with threat hunting.

Purpose of the Study:

• Introduce PROID, a novel, comprehensive, and data-driven framework for Compromise Assessment (CA).
• Address the lack of standardized methodologies in CA and the ambiguity between CA and threat hunting.
• Provide organizations with a reliable method for assessing compromise status and enhancing resilience.

Main Methods:

• PROID integrates Threat Intelligence and Threat Hunting using a multi-layered analytical approach.
• Combines signature-based and signature-less hunting, automated pattern recognition, and human-led analysis.
• Tested in a simulated enterprise environment against 31 MITRE ATT&CK techniques across host, network, and application layers.

Main Results:

• PROID successfully detected all 31 tested MITRE ATT&CK techniques, including persistence, defense evasion, and anti-forensics.
• Demonstrated broad detection capabilities and effectiveness in unifying diverse analysis methods.
• Outperformed other methodologies in consistently identifying advanced threat behaviors.

Conclusions:

• PROID establishes a standardized and reproducible basis for Compromise Assessment, reducing ambiguity with threat hunting.
• Offers a practical means for organizations to conduct periodic assurance of compromise status.
• Serves as a valuable reference model to complement real-time monitoring and bolster resilience against advanced threats.