693356 event 1792584846 1792584906 <![CDATA[Ph.D. Dissertation Defense - Tillson Galloway]]> Title:  Demystifying Operational Gaps in the Threat Intelligence Ecosystem

Committee:

Dr. Fabian Monrose, ECE, Chair, Advisor

Dr. Manos Antonakakis, ECE

Dr. Roberto Perdisci, UGA

Dr. Paul Pearce, UC Irvine

Dr. Angelos Keromytis, ECE

]]> Threat intelligence helps defenders disrupt malicious infrastructure, but opaque collection, analysis, and dissemination
processes obscure its operational limitations. This dissertation develops active external measurements to reveal gaps in
accuracy, coverage, context, and timeliness. Executable probes and instrumented servers trace artifact extraction,
propagation, and defensive action across 30 security vendors, exposing incomplete analysis and dissemination. Controlled experiments and large-scale crawling reveal retrieval and execution failures on shared hosting platforms and
missing associations between recovered binaries and their originating URLs. To address these gaps, targeted collection
and multimodal analysis identify malicious GitHub repositories and software packages. A 45-day evaluation spanning
approximately 13.5 million repositories uncovers 4,261 previously unreported malicious repositories, contributing to over
4,000 takedowns. Finally, experiments with GitHub and DNS detection systems demonstrate how low-cost adversarial
manipulation undermines classification and artifact validation. Together, these studies establish methods for auditing
threat intelligence systems and inform improvements to collection, provenance, dissemination, and detection robustness.

]]> <![CDATA[]]> 434381 1788 100811 1808