A Threat Intelligence Analysis Method Based on Feature Weighting and BERT-BiGRU for Industrial Internet of Things

Abstract

The combination of 5G technology and the industrial Internet of things (IIoT) makes it possible to realize the interconnection of all things. Still, it also increases the risk of attacks such as large-scale DDoS attacks and IP spoofing attacks. Threat intelligence is a collection of information causing potential and nonpotential harm to the industrial Internet. Extracting network security entities and their relationships from threat intelligence text and constructing structured threat intelligence information are particularly important for IIoT security protection. However, threat intelligence is mostly text reports, which means the value information needs to be extracted manually by security analysts, and it is highly dependent on personnel experience. Therefore, this study proposes an IIoT threat intelligence analysis method based on feature weighting and BERT-BiGRU. In this method, BERT-BiGRU is used to classify attack behavior and attack strategy. Then, the attack behavior is weighted to make the classified result more accurate according to the relationship between attack strategy and attack behavior in ATT&CK for ICS knowledge. Finally, the possibility of attack and the harm degree of attack are calculated to form the threat value of the attack. The security analysts can judge the emergency response sequence by the threat value to improve the accuracy and efficiency of emergency response. The results indicate that the proposed method in this study is more accurate than the other standard methods and is more suitable for the unstructured threat intelligence analysis of IIoT.

CDTier: A Chinese Dataset of Threat Intelligence Entity Relationships

“…In threatening behavior analysis, TTPDrill [25] utilized Natural Language Processing techniques and Information Retrieval methods to extract threat actions from unstructured CTI text. Yan et al [26]. used BERT-BiGRU to classify attack behaviors and attack strategies described in threat intelligence, thereby calculating the possibility of attacks and the degree of harm of attacks, especially for unstructured threat intelligence analysis of IIoT (Industrial Internet of Things).…”

An Automatic Assessment Method of Cyber Threat Intelligence Combined with ATT&CK Matrix

“…Luo et al [27] proposed EDL-WADS, a deep learning-based network attack detection system that used all three models of CNN, MRN, and LSTM for network attack detection. Yan et al [28] used two techniques of feature weighting and BERT-BiGRU and proposed a method to analyze IIoT threat intelligence, which could realize automatic identification of attack behavior and attack strategies. Wang et al [29] improved the PCNN-ATT model and proposed a DRL-ETPCNN-ATT-based method for remote supervised relation extraction, which could extract threat intelligence from unstructured text.…”

IMCSA: Providing Better Sequence Alignment Space for Industrial Control Protocol Reverse Engineering

“…Terefore, industrial control protocols have become a common target for attackers to carry out network attacks. Conversely, industrial control protocols have also become the focus of defense against these attacks [4][5][6]. However, because of commercial and security factors, most industrial control protocol specifcations are not open to the public [7,8].…”