SOCCRATES: Enhanced Cybersecurity through Automation

Instability breeds innovation

Every day, as the number and complexity of cyber threats grow, IT teams and security specialists work tirelessly to defend against them. As part of an ambitious Horizon 2020 project, the SOCCRATES team of experts has developed the tools and platform to make this essential job more manageable, and to ensure well-informed, effective decision-making when it matters most.

In the three years since the SOCCRATES project began, the cyber threat landscape has intensified. Global instability and geopolitical conflicts have increased cyber criminality. And, as cybercriminals become more sophisticated, Security Operation Centers (SOCs) and Computer Security Incident Response Teams (CSIRTSs) must also grow stronger. And the best way to do that, is to develop automated solutions in collaboration with each other.

SOCCRATES brought together the most highly skilled experts in their respective fields – from universities to end users to service providers to technology providers – to collaborate on the development of a security automation and decision support platform. As an independent knowledge institute, TNO not only served as Technical and Overall Coordinator for the project, but also contributed key technology to the platform.

Automation for acceleration

Perhaps the most unique aspect of the SOCCRATES platform is its robustness. Instead of modules that support a single aspect of cybersecurity, SOCCRATES provides support for every step of the security process, from threat identification to analysis to mitigation or defence.

The comprehensive SOCCRATES platform, now available for demonstration, aims to automate as many elements of cybersecurity as possible, to enable swift and effective decisions about the best course of protective action. SOCCRATES does not replace human defenders, but rather offers tools and insights that make it easier and more straightforward for SOCs and CSIRTs to select the appropriate response.

Next-generation security

While current Security Orchestration, Automation and Response (SOAR) tools provide a playbook for managing known threats, SOCCRATES goes much further. The main benefits of the platform are that it enhances SOC or CSIRT’s situational awareness and option awareness. It can analyse the business impact of each threat, and offer insight into the benefits and drawbacks of each potential defence action.

In addition to a demo version of the entire SOCCRATES platform, the SOCCRATES consortium also made several modules open source on GitHub, so that SOCs and CSIRTs can test and use them as needed. First, the Adversary Emulation Planner automatically builds an ordered set of attack stages that show all possible techniques that an adversary might execute during an attack.

The Course of Action Generator helps SOCs and CSIRTs explore the various options available to respond to an attack. And the DGA Detective determines whether or not a given domain name was created by a Domain Generation Algorithm (DGA), one of the key challenges of botnet cybercriminality. Other SOCCRATES modules will be made open source before the project closes, and some modules will be implemented into the security software systems of participating partners.

Future focus

Although the SOCCRATES project will soon end, the advancements made during this initiative will live on. In addition to making use of the open-source modules and demo version of the platform, SOC and CSIRT analysts, software developers and vendors will benefit from the integration of SOCCRATES results into the products developed by the project’s partners. The project experts hope to build further on the technology they created.

One project proposal involves the Operational Technology (OT) domain, which are the systems that manage public works, public transport, and more. The team aims to build on the foundations established within SOCCRATES to bring situational and option awareness to both the IT and OT infrastructures at the same time.