While researching for my new book The Tao of Network Security Monitoring, I wanted to read articles published in scholarly journals and other academic forums. I found the CiteSeer Scientific Literature Digital Library to be extremely valuable. You can query by keywords or browse collections like Intrusion Detection by date. When you come across a paper with lots of citations, like Intrusion Detection: A Bibliography, they are usually linked. The University of California at Davis offers a Computer Security Archives Project where older but useful papers are kept. I found Todd Heberlein's site archives all of his papers, including those on network security monitoring. Honeypots.net, not part of the Honeynet Project, contains lots of references. Citeseer event mentions a paper I wrote.
MITRE ATT&CK Tactics Are Not Tactics
Just what are "tactics"? Introduction MITRE ATT&CK is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
