K-CTIAA: Automatic Analysis of Cyber Threat Intelligence Based on a Knowledge Graph

被引:15
作者
Li, Zong-Xun [1 ]
Li, Yu-Jun [1 ]
Liu, Yi-Wei [1 ]
Liu, Cheng [1 ,2 ]
Zhou, Nan-Xin [1 ]
机构
[1] Univ Elect Sci & Technol China, Sch Comp Sci & Engn, Chengdu 611731, Peoples R China
[2] 30th Res Inst China Elect Technol Grp Corp, Sci & Technol Commun Secur Lab, Chengdu 610041, Peoples R China
来源
SYMMETRY-BASEL | 2023年 / 15卷 / 02期
关键词
cyber threat intelligence; pre-trained model; threat action extraction; cyber security knowledge graph;
D O I
10.3390/sym15020337
中图分类号
O [数理科学和化学]; P [天文学、地球科学]; Q [生物科学]; N [自然科学总论];
学科分类号
07 ; 0710 ; 09 ;
摘要
Cyber threat intelligence (CTI) sharing has gradually become an important means of dealing with security threats. Considering the growth of cyber threat intelligence, the quick analysis of threats has become a hot topic at present. Researchers have proposed some machine learning and deep learning models to automatically analyze these immense amounts of cyber threat intelligence. However, due to a large amount of network security terminology in CTI, these models based on open-domain corpus perform poorly in the CTI automatic analysis task. To address this problem, we propose an automatic CTI analysis method named K-CTIAA, which can extract threat actions from unstructured CTI by pre-trained models and knowledge graphs. First, the related knowledge in knowledge graphs will be supplemented to the corresponding position in CTI through knowledge query and knowledge insertion, which help the pre-trained model understand the semantics of network security terms and extract threat actions. Second, K-CTIAA reduces the adverse effects of knowledge insertion, usually called the knowledge noise problem, by introducing a visibility matrix and modifying the calculation formula of the self-attention. Third, K-CTIAA maps corresponding countermeasures by using digital artifacts, which can provide some feasible suggestions to prevent attacks. In the test data set, the F1 score of K-CTIAA reaches 0.941. The experimental results show that K-CTIAA can improve the performance of automatic threat intelligence analysis and it has certain significance for dealing with security threats.
引用
收藏
页数:18
相关论文
共 38 条
[1]  
Abu Md Sahrom, 2018, Indones. J. Electr. Eng. Comput. Sci., V10, P371, DOI 10.11591/ijeecs.v10.i1.pp371-379
[2]  
[Anonymous], Pdfminer
[3]  
[Anonymous], D3FEND A KNOWLEDGE G
[4]  
[Anonymous], AIDA YY KNOWLEDGE GR
[5]  
[Anonymous], MOST RECENT CYBER AT
[6]  
[Anonymous], HOLOLEN CYBERSECURIT
[7]   A Study of Sentiment Analysis Algorithms for Agricultural Product Reviews Based on Improved BERT Model [J].
Cao, Ying ;
Sun, Zhexing ;
Li, Ling ;
Mo, Weinan .
SYMMETRY-BASEL, 2022, 14 (08)
[8]  
Devlin J, 2019, Arxiv, DOI [arXiv:1810.04805, 10.48550/arxiv.1810.04805]
[9]  
Fujii S., 2022, LECT NOTES COMPUTER, P85
[10]   Pre-trained models: Past, present and future [J].
Han, Xu ;
Zhang, Zhengyan ;
Ding, Ning ;
Gu, Yuxian ;
Liu, Xiao ;
Huo, Yuqi ;
Qiu, Jiezhong ;
Yao, Yuan ;
Zhang, Ao ;
Zhang, Liang ;
Han, Wentao ;
Huang, Minlie ;
Jin, Qin ;
Lan, Yanyan ;
Liu, Yang ;
Liu, Zhiyuan ;
Lu, Zhiwu ;
Qiu, Xipeng ;
Song, Ruihua ;
Tang, Jie ;
Wen, Ji-Rong ;
Yuan, Jinhui ;
Zhao, Wayne Xin ;
Zhu, Jun .
AI OPEN, 2021, 2 :225-250