Cybersecurity experts hunting for hackers.

• Author: Tadjdeh, Yasmin

Network security professionals are turning to an emerging concept known as "cyber threat hunting" to ferret out hackers from critical systems, said one expert.

"It's designed to help surface threats that have evaded detection by other tools and sensors," said Ely Kahn, co-founder and vice president at Sqrrl, a cybersecurity company based in Cambridge, Massachusetts.

Advanced threats can find their way around firewalls and perimeter security devices, he said. Often, they are undetected by traditional signature or rule-based systems, said Kahn, who also previously served as director of cybersecurity on the national security staff in the White House.

Threat hunting, on the other hand, is a "proactive human-driven approach to find the subtle indicators of those lurking threats that are already inside your network," he told National Defense.

Sqrrl's threat hunting platform is currently in use at a number of large security centers around the world, Kahn said. Traditional systems often look at low-level indicators when searching for intrusions, such as suspicious IP addresses. However, "what we actually recommend is instead of focusing on those lower level indicators... to hunt for the higher or more complex indicators that are often times referred to as TTPs--the tactics, techniques and procedures of cyber adversaries," he said.

Typically, with a high-level indicator, an analyst is looking for a pattern, he said.

Sqrrl's platform requires a human to be in the loop.

"[We] simplify the hunt by packaging together...