TY - GEN
T1 - OTuHunt
T2 - 12th International Scientific Conference on Information Technology, ICIT 2025
AU - Alaliwat, Fatimah
AU - Alqahtani, Lena
AU - Alzahrani, Manar
AU - Alamoudi, Nouf
AU - Hakami, Shaima
AU - Alharby, Abdulrahman
AU - Alharbi, Nawaf
N1 - Publisher Copyright:
© 2025 IEEE.
PY - 2025
Y1 - 2025
N2 - The convergence of IT and OT systems has height-ened cybersecurity risks, especially in OT/ICS environments where attacks can impact critical infrastructure. This paper proposes "OTuHunt", a conceptual framework to automate the extraction of Indicator of Compromise (IoC) and Tactics, Techniques, and Procedures (TTPs) from local reports and unstructured Cyber Threat Intelligence (CTI), using Natural Language Processing (NLP), aligning with the Managed Security Service Provider (MSSP) model. Extracted TTPs are mapped to MITRE ATT&CK for ICS and transformed into Security Information and Event Management (SIEM)-compatible queries. While still in the proposal stage, "OTuHunt"aims to provide an end-to-end automated threat hunting pipeline tailored to OT/ICS, addressing gaps in current solutions and enhancing early Advanced Persistent Threat (APT) detection in support of secure digital transformation.
AB - The convergence of IT and OT systems has height-ened cybersecurity risks, especially in OT/ICS environments where attacks can impact critical infrastructure. This paper proposes "OTuHunt", a conceptual framework to automate the extraction of Indicator of Compromise (IoC) and Tactics, Techniques, and Procedures (TTPs) from local reports and unstructured Cyber Threat Intelligence (CTI), using Natural Language Processing (NLP), aligning with the Managed Security Service Provider (MSSP) model. Extracted TTPs are mapped to MITRE ATT&CK for ICS and transformed into Security Information and Event Management (SIEM)-compatible queries. While still in the proposal stage, "OTuHunt"aims to provide an end-to-end automated threat hunting pipeline tailored to OT/ICS, addressing gaps in current solutions and enhancing early Advanced Persistent Threat (APT) detection in support of secure digital transformation.
UR - https://www.scopus.com/pages/publications/105011953821
U2 - 10.1109/ICIT64950.2025.11049292
DO - 10.1109/ICIT64950.2025.11049292
M3 - Conference contribution
AN - SCOPUS:105011953821
T3 - Proceeding - 12th International Conference on Information Technology: Innovation Technologies, ICIT 2025
SP - 39
EP - 46
BT - Proceeding - 12th International Conference on Information Technology
A2 - Jaber, Khalid Mohammad
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 27 May 2025 through 30 May 2025
ER -