The Diamond Model of Intrusion Analysis (2013) [pdf]

threatconnect.com

30 pointsbootload3 comments

I deplore the practice of publishing papers without a date. This could have been written any time between 2012 and last week based on the sources referenced.

It mentions 2013 in the text, and there's no sign of 2014+, so we'll call it 2013.

Good call - the paper was published July 5th, 2013. I believe it was originally published here:

http://www.dtic.mil/docs/citations/ADA586960

I should also note that this paper is worth reading if simply to make one aware of how to view an intrusion from different perspectives.

Reply on news.ycombinator.com