Accurify: Automated New Testflows Generation for Attack Variants in Threat Hunting

In the ever-evolving landscape of cyber security, threat hunting has emerged as a proactive defense line to detect advanced threats. To evade detection, the attackers constantly change their techniques and tactics creating new attack variants. However, the manual creation and execution of testflows to test the attacks and their variants generated by threat hunting systems remain a strenuous task that requires elusive knowledge and is time-consuming. This paper introduces Accurify, a solution that automates the generation of new testflows to test the existence of attack variants using machine reasoning. Accurify leverages case-based machine reasoning to find similar already-encountered cases from a security playbook and then reuses them to generate and adjust new testflows tailored to the attack variant in question. By analyzing historical threat data and incorporating real-time threat intelligence feeds, Accurify can generate new testflows for attack variants with high accuracy and precision, validated using real-world dataset. By automating the testflow generation, Accurify enhances the effectiveness of threat hunting and frees security professionals to focus on strategic aspects of cybersecurity operations.