update abstract and add PDF link

_pages/index.md

@@ -7,12 +7,14 @@ title: "Providing Threat Intelligence with an Internet-wide TLS Ecosystem Graph
 description: "Additional material for the publication \"Propagating Threat Scores With a TLS Ecosystem Graph Model Derived by Active Measurements\", providing access to published data and tools."
 ---
 
+Read our final version over ifip: *[[PDF]](https://tma.ifip.org/2024/wp-content/uploads/sites/13/2024/05/tma2024-final19.pdf)*
+
 <div class="accordion-box">
   <div class="accordion-box__title">
     Abstract
   </div>
   <div class="accordion-box__content">
-      <p>Independent actors and heterogeneous deployments shape the Internet. With the wide adoption of Transport Layer Security (TLS), a whole ecosystem of intertwined entities emerged. A comprehensive view allows searching for previously unknown malicious entities and providing valuable cyber-threat intelligence. Actively collected Domain Name System (DNS) and TLS meta-data can provide the basis of such large-scale analyses. However, an efficient methodology to navigate the vast data is necessary to provide this information. This work proposes a graph model of the TLS ecosystem that utilizes the relations among servers, domains, and certificates. A Probabilistic Threat Propagation (PTP) algorithm enables the propagation of a threat score from existing blocklists to related nodes. We conducted a one-year-long measurement study of 13 monthly active Internet-wide DNS and TLS measurements to evaluate the methodology. Our latest measurement found four highly suspicious clusters among the nodes with high threat scores. We confirmed a high rate of maliciousness in the rest of the newly found servers using external threat intelligence services. With the help of optimized thresholds, we identified 557 domains and 11 IP addresses throughout the last year before they were known to be malicious. Up to 40% of the identified nodes appeared on average three months later on the input blocklist. This work proposes a versatile graph model to analyze the TLS ecosystem. Moreover, a PTP analysis allows focusing on suspicious subsets of the Internet that can serve as a starting point for security researchers looking for unknown threats on the Internet.</p>
+      <p>The Internet is shaped by independent actors and heterogeneous deployments. With the wide adoption of Transport Layer Security (TLS), a whole ecosystem of intertwined entities emerged. Acquiring a comprehensive view allows searching for previously unknown malicious entities and providing valuable cyber-threat intelligence. Actively collected Internet-wide Domain Name System (DNS) and TLS meta-data can provide the basis for such large-scale analyses. However, in order to efficiently navigate the vast volumes of data, an effective methodology is required. This work proposes a graph model of the TLS ecosystem that utilizes the relationships between servers, domains, and certificates. A Probabilistic Threat Propagation (PTP) algorithm is then used to propagate a threat score from existing blocklists to related nodes. We conducted a one-year-long measurement study of 13 monthly active Internet-wide DNS and TLS measurements to evaluate the methodology. The latest measurement found four highly suspicious clusters among the nodes with high threat scores. External threat intelligence services were used to confirm a high rate of maliciousness in the rest of the newly found servers. With the help of optimized thresholds, we identified 557 domains and 11 IP addresses throughout the last year before they were known to be malicious. Up to 40% of the identified nodes appeared on average three months later on the input blocklist. This work proposes a versatile graph model to analyze the TLS ecosystem and a PTP analysis to help security researchers focus on suspicious subsets of the Internet when searching for unknown threats.</p>
   </div>
 </div><br>