K-CTIAA: Automatic Analysis of Cyber Threat Intelligence Based on a Knowledge Graph

被引:15
作者
Li, Zong-Xun [1 ]
Li, Yu-Jun [1 ]
Liu, Yi-Wei [1 ]
Liu, Cheng [1 ,2 ]
Zhou, Nan-Xin [1 ]
机构
[1] Univ Elect Sci & Technol China, Sch Comp Sci & Engn, Chengdu 611731, Peoples R China
[2] 30th Res Inst China Elect Technol Grp Corp, Sci & Technol Commun Secur Lab, Chengdu 610041, Peoples R China
来源
SYMMETRY-BASEL | 2023年 / 15卷 / 02期
关键词
cyber threat intelligence; pre-trained model; threat action extraction; cyber security knowledge graph;
D O I
10.3390/sym15020337
中图分类号
O [数理科学和化学]; P [天文学、地球科学]; Q [生物科学]; N [自然科学总论];
学科分类号
07 ; 0710 ; 09 ;
摘要
Cyber threat intelligence (CTI) sharing has gradually become an important means of dealing with security threats. Considering the growth of cyber threat intelligence, the quick analysis of threats has become a hot topic at present. Researchers have proposed some machine learning and deep learning models to automatically analyze these immense amounts of cyber threat intelligence. However, due to a large amount of network security terminology in CTI, these models based on open-domain corpus perform poorly in the CTI automatic analysis task. To address this problem, we propose an automatic CTI analysis method named K-CTIAA, which can extract threat actions from unstructured CTI by pre-trained models and knowledge graphs. First, the related knowledge in knowledge graphs will be supplemented to the corresponding position in CTI through knowledge query and knowledge insertion, which help the pre-trained model understand the semantics of network security terms and extract threat actions. Second, K-CTIAA reduces the adverse effects of knowledge insertion, usually called the knowledge noise problem, by introducing a visibility matrix and modifying the calculation formula of the self-attention. Third, K-CTIAA maps corresponding countermeasures by using digital artifacts, which can provide some feasible suggestions to prevent attacks. In the test data set, the F1 score of K-CTIAA reaches 0.941. The experimental results show that K-CTIAA can improve the performance of automatic threat intelligence analysis and it has certain significance for dealing with security threats.
引用
收藏
页数:18
相关论文
共 38 条
[11]   An Ontology of Information Security [J].
Herzog, Almut ;
Shahmehri, Nahid ;
Duma, Claudiu .
INTERNATIONAL JOURNAL OF INFORMATION SECURITY AND PRIVACY, 2007, 1 (04) :1-23
[12]   TTPDrill: Automatic and Accurate Extraction of Threat Actions from Unstructured Text of CTI Sources [J].
Husari, Ghaith ;
Al -Shaer, Ehab ;
Ahmed, Mohiuddin ;
Chu, Bill ;
Niu, Xi .
33RD ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE (ACSAC 2017), 2017, :103-115
[13]  
Husari G, 2018, 2018 IEEE INTERNATIONAL CONFERENCE ON INTELLIGENCE AND SECURITY INFORMATICS (ISI), P1, DOI 10.1109/ISI.2018.8587343
[14]   A Practical Approach to Constructing a Knowledge Graph for Cybersecurity [J].
Jia, Yan ;
Qi, Yulu ;
Shang, Huaijun ;
Jiang, Rong ;
Li, Aiping .
ENGINEERING, 2018, 4 (01) :53-60
[15]  
kbandla/APTnotes, VAR PUBL DOC WHIT AR
[16]  
Li Kun, 2020, Security and Privacy in Digital Economy: First International Conference, SPDE 2020. Communications in Computer and Information Science (1268), P100, DOI 10.1007/978-981-15-9129-7_8
[17]  
Liu WJ, 2020, AAAI CONF ARTIF INTE, V34, P2901
[18]   MRE: A Military Relation Extraction Model Based on BiGRU and Multi-Head Attention [J].
Lu, Yiwei ;
Yang, Ruopeng ;
Jiang, Xuping ;
Zhou, Dan ;
Yin, Changsheng ;
Li, Zizhuo .
SYMMETRY-BASEL, 2021, 13 (09)
[19]  
MITRE|ATT&CK, US
[20]  
Niakanlahiji A, 2018, IEEE INT CONF BIG DA, P2995, DOI 10.1109/BigData.2018.8622255