Detection Engineering for Zero-Day Threats: Bridging Intelligence and Automation
DOI:
https://doi.org/10.47941/ijce.3952Keywords:
Detection Engineering, Zero-Day Threats, Cyber Threat Intelligence, Security, Automation, SIEM, SOAR, MITRE ATT&CK, Threat Hunting, EDR, XDR, Artificial IntelligenceAbstract
Zero-day threats represent one of the most significant challenges in modern cybersecurity because they exploit previously unknown vulnerabilities before security vendors can develop signatures or patches. Traditional signature-based detection mechanisms are increasingly ineffective against these rapidly evolving attacks, creating a need for proactive, intelligence-driven detection strategies. Detection engineering has emerged as a discipline that combines threat intelligence, behavioral analytics, telemetry correlation, and automated response to identify malicious activity independent of known indicators of compromise. This paper examines how detection engineering can bridge cyber threat intelligence and security automation to improve the identification and mitigation of zero-day threats. It reviews the evolution of detection methodologies from static rule-based systems to behavior-based analytics supported by artificial intelligence, machine learning, and Security Orchestration, Automation, and Response (SOAR) platforms. The article further explores the integration of frameworks such as MITRE ATT&CK, threat hunting methodologies, endpoint detection and response (EDR), extended detection and response (XDR), and cloud-native security monitoring to build adaptive detection capabilities. Challenges including false positives, intelligence quality, adversarial evasion techniques, privacy considerations, and automation reliability are critically analyzed. The paper proposes a conceptual framework that integrates continuous threat intelligence, automated detection engineering, and adaptive response workflows to enhance organizational cyber resilience against zero-day attacks. The findings demonstrate that combining intelligence-driven detection engineering with automated security operations significantly improves early detection, reduces mean time to detect (MTTD), and strengthens defenses against previously unknown cyber threats.
Downloads
References
[1] E. Hutchins, M. Cloppert, and R. Amin, "Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains," Leading Issues in Information Warfare & Security Research, vol. 1, no. 1, pp. 80–106, 2011.
[2] S. Axelsson, "The base-rate fallacy and the difficulty of intrusion detection," ACM Transactions on Information and System Security, vol. 3, no. 3, pp. 186–205, Aug. 2000.
[3] MITRE Corporation, MITRE ATT&CK®: Design and Philosophy, Technical Report, MITRE, McLean, VA, USA, 2020.
[4] R. Sommer and V. Paxson, "Outside the closed world: On using machine learning for network intrusion detection," in Proc. IEEE Symposium on Security and Privacy, Oakland, CA, USA, 2010, pp. 305–316.
[5] MITRE Corporation, MITRE ATT&CK® Evaluations: A Roadmap for Measuring Enterprise Security Capabilities, McLean, VA, USA, 2021.
[6] R. Bejtlich, The Practice of Network Security Monitoring: Understanding Incident Detection and Response. San Francisco, CA, USA: No Starch Press, 2013.
[7] R. Bejtlich, The Practice of Network Security Monitoring: Understanding Incident Detection and Response. San Francisco, CA, USA: No Starch Press, 2013.
[8] A. O. Balogun and S. Basri, "Cyber security event management: A review of SIEM architecture, challenges and future directions," Journal of Information Security and Applications, vol. 58, Art. no. 102748, 2021.
[9] MITRE Corporation, MITRE ATT&CK®: Design and Philosophy, McLean, VA, USA, Technical Report, 2020.
[10] D. Bianco, "The Pyramid of Pain," Pyramid of Pain Project, 2014.
[11] M. Conti, T. Dargahi, and A. Dehghantanha, "Cyber threat intelligence: Challenges and opportunities," in Cyber Threat Intelligence, Cham, Switzerland: Springer, 2018, pp. 1–25.
[12] R. M. Lee, M. J. Assante, and T. Conway, Analysis of the Cyber Attack on the Ukrainian Power Grid, SANS Industrial Control Systems, 2016.
[13] National Institute of Standards and Technology (NIST), Computer Security Incident Handling Guide, NIST Special Publication 800-61 Revision 2, Gaithersburg, MD, USA, Aug. 2012.
[14] D. Bianco and J. Spring, Detecting the Adversary with ATT&CK®, MITRE Engenuity Center for Threat-Informed Defense, McLean, VA, USA, 2022.
[15] OASIS, STIX™ Version 2.1. Part 1: STIX Core Concepts, Committee Specification 01, OASIS Open, Feb. 2021.
[16] OASIS, TAXII™ Version 2.1. Trusted Automated eXchange of Indicator Information, Committee Specification 01, OASIS Open, Feb. 2021.
[17] MITRE Engenuity Center for Threat-Informed Defense, Summiting the Pyramid: Constructing a Threat-Informed Defense Program, McLean, VA, USA, 2021.
[18] National Institute of Standards and Technology (NIST), Security and Privacy Controls for Information Systems and Organizations, NIST Special Publication 800-53 Revision 5, Gaithersburg, MD, USA, Sept. 2020.
[19] National Institute of Standards and Technology (NIST), Guide for Cybersecurity Event Recovery, NIST Special Publication 800-184, Gaithersburg, MD, USA, Dec. 2016.
[20] R. Sommer and V. Paxson, "Outside the closed world: On using machine learning for network intrusion detection," in Proc. IEEE Symposium on Security and Privacy, Oakland, CA, USA, 2010, pp. 305–316.
[21] European Union Agency for Cybersecurity (ENISA), ENISA Threat Landscape 2022, Heraklion, Greece, 2022.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2023 Bhuvan Bobba
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution (CC-BY) 4.0 License that allows others to share the work with an acknowledgment of the work's authorship and initial publication in this journal.
