Signalling for cyber threat intelligence using cryptographic protocols

This thesis explores the use of cryptographic protocols to solve challenges regarding confidentiality, trust and risk when sharing sensitive information related to Cyber Threat Intelligence. Ideally, Cyber Threat Intelligence communities greatly benefit from trans parent communication to quickly adapt to emerging threats, however, privacy constraints, sharing policies and trust levels limit the quality and quantity of information that can be exchanged. In this thesis, solutions are proposed with signals. The concept of a signal is an electronic message that carries information only intelligible or actionable to authorised entities. These signals contain information as part of communication exchanges or as a control mechanism for some protocol. This is used for communication where participants have limited trust in each other or have considered a communication channel to have a level of risk. To achieve this confidentiality, signals are derived from various cryptographic schemes which may produce ciphertext or plaintext such as zero-knowledge proofs and secret sharing schemes. Applications of signalling are implemented which demonstrate their effectiveness, efficiency and practicality in protecting sensitive information in scenarios where entities want to share information but have limited trust. These include cyber-evidence in the finance industry, that is, sharing suspicious transactions for anti money laundering. Detecting changes and verifying mutual information in large sets of proofs and also mitigating risks of sharing in Cyber Threat Intelligence communities. Additionally, signals can be used by individuals who wish to share Cyber Threat Intelligence whilst avoiding monitoring agents through a hybrid steganography and secret sharing approach. The thesis concludes by establishing that signals are an effective type of message to solve confidentiality, trust and risk of sharing sensitive information. Signals are imperative for Cyber Threat Intelligence communities’ threat analysis and situational awareness because the use of cryptographic schemes can be incorporated into automated systems and are practical such that implementing them is straightforward and computationally efficient.