Recent Progress of Using Knowledge Graph for Cybersecurity

Liu, Kai; Wang, Fei; Ding, Zhaoyun; Shen, Liang; Yu, Zhengfei; Zhou, Yun

doi:10.3390/electronics11152287

Cited by 31 publications

(24 citation statements)

References 90 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In cybersecurity and cyber intelligence, the use of knowledge graphs and linked data has been prevalent due to the mostly structured nature of the recorded data related to intrusion detection systems, software vulnerabilities and malicious actors 3 , 19 . For instance, online databases like NVD 20 , CVE 21 and CWE 22 provide regular updates on software and system vulnerabilities in a structured format.…”

Section: Related Workmentioning

confidence: 99%

“…An ad-hoc structuring of information by interlinking reports on events, i.e. a knowledge graph framework [3][4][5][6] , appears to be a viable solution. The concept of knowledge graphs has been adopted for structuring and processing of technical information on known vulnerabilities, malicious IP addresses and different relevant threats in the cyberdomain, as well as for associating other related entities such as software companies.…”

mentioning

confidence: 99%

See 1 more Smart Citation

Knowledge mining of unstructured information: application to cyber domain

Takko

Bhattacharya

Lehto

et al. 2023

Sci Rep

View full text Add to dashboard Cite

Information on cyber-related crimes, incidents, and conflicts is abundantly available in numerous open online sources. However, processing large volumes and streams of data is a challenging task for the analysts and experts, and entails the need for newer methods and techniques. In this article we present and implement a novel knowledge graph and knowledge mining framework for extracting the relevant information from free-form text about incidents in the cyber domain. The computational framework includes a machine learning-based pipeline for generating graphs of organizations, countries, industries, products and attackers with a non-technical cyber-ontology. The extracted knowledge graph is utilized to estimate the incidence of cyberattacks within a given graph configuration. We use publicly available collections of real cyber-incident reports to test the efficacy of our methods. The knowledge extraction is found to be sufficiently accurate, and the graph-based threat estimation demonstrates a level of correlation with the actual records of attacks. In practical use, an analyst utilizing the presented framework can infer additional information from the current cyber-landscape in terms of the risk to various entities and its propagation between industries and countries.

show abstract

Section: Related Workmentioning

confidence: 99%

mentioning

confidence: 99%

Knowledge mining of unstructured information: application to cyber domain

Takko

Bhattacharya

Lehto

et al. 2023

Sci Rep

View full text Add to dashboard Cite

show abstract

“…Examples include the Situation and Threat Understanding by Correlating Contextual Observations (STUCCO) ontology (Iannacone et al, 2015) and the Unified Cyber Ontology (UCO) (Syed et al, 2016). Many open-source libraries also contain ontologies for the knowledge graph construction (Liu et al, 2022). Many types of graphs have been developed in the cybersecurity domain.…”

Section: Introductionmentioning

confidence: 99%

“…There also have been many graphs developed that focus on security assessments (Zhang and Liu, 2020) and network security analytics (Noel, 2018). Kurniawan et al (2022) and Liu et al (2022) identified a research need after examining reviews of previous cybersecurity knowledge-graph studies (Ding, Liu, and Zhu, 2020;Dong et al, 2020;and Yan and Liu, 2020). The identified research need consists of showing how knowledge graphs can be used to practical problems in cybersecurity at a broader scale than on a specific type of network with specific types of devices.…”

Section: Introductionmentioning

confidence: 99%

Development and Analysis of a Reconnaissance-Technique Knowledge Graph

Heverin

Deitz²,

Cohen³

et al. 2023

iccws

View full text Add to dashboard Cite

Penetration testing involves the use of many tools and techniques. The first stage of penetration testing involves conducting reconnaissance on a target organization. In the reconnaissance phase, adversaries use tools to find network data, people data, company/organization data, and attack data to generate a risk assessment about a target to determine where initial weaknesses may be. Although a small number of tools can be used to conduct many of reconnaissance tasks, including Shodan, Nmap, Recon-ng, Maltego, Metasploit, Google and more, each tool holds an abundance of specific techniques that can be used. Furthermore, each technique uses unique syntax. For example, Nmap holds over 600 scripts that make up its Nmap Scripting Engine. Depending on the type of device targeted, Nmap scripts can scan for ports, operating systems, IP addresses, hostnames and more. As another example, Maltego operates over 150 transforms or modules that collect data on organizations, files and people. Understanding which reconnaissance tool, techniques within those tools, and the syntax for each technique represents a highly complex task. MITRE ATT&CK, a widely accepted framework, models tactics and techniques within the tactics to help users make sense of adversarial behaviours. The tactic of reconnaissance is modelled in ATT&CK as well as its techniques. However, the explicit links between reconnaissance techniques are not modelled. Our research focused on the development of an ontology called Recontology to model the domain of reconnaissance. Recontology was then used to form Reconnaissance-Technique Graph (RT-Graph) to model 102 reconnaissance techniques and the directional links between the techniques. We used exploratory data analysis (EDA) methods including a graph spatial-layout algorithm and several graph-statistical algorithms to examine RT-Graph. We also used EDA to find critical techniques within the graph. Patterns across the results are discussed as well as implications for real-world uses of RT-Graph.

show abstract

“…KG helps to systematize, handle, and use large amounts of complex knowledge in ontology-based and heterogeneous systems in cyberspace, enabling analysts to query and act on the data. Recent advantages in KG representation and modeling have been proven effective in creating, using and tackling real-world issues in cyberattacks and defense (Liu et al , 2022). Applying such advances in the cybersecurity defense domain using preexisting open-linked data resources can effectively identify hidden patterns in the offensive technique.…”

Section: Introductionmentioning

confidence: 99%

Infer the missing facts of D3FEND using knowledge graph representation learning

Khobragade

Ghumbre²,

Pachghare

2023

IJWIS

View full text Add to dashboard Cite

Purpose MITRE and the National Security Agency cooperatively developed and maintained a D3FEND knowledge graph (KG). It provides concepts as an entity from the cybersecurity countermeasure domain, such as dynamic, emulated and file analysis. Those entities are linked by applying relationships such as analyze, may_contains and encrypt. A fundamental challenge for collaborative designers is to encode knowledge and efficiently interrelate the cyber-domain facts generated daily. However, the designers manually update the graph contents with new or missing facts to enrich the knowledge. This paper aims to propose an automated approach to predict the missing facts using the link prediction task, leveraging embedding as representation learning. Design/methodology/approach D3FEND is available in the resource description framework (RDF) format. In the preprocessing step, the facts in RDF format converted to subject–predicate–object triplet format contain 5,967 entities and 98 relationship types. Progressive distance-based, bilinear and convolutional embedding models are applied to learn the embeddings of entities and relations. This study presents a link prediction task to infer missing facts using learned embeddings. Findings Experimental results show that the translational model performs well on high-rank results, whereas the bilinear model is superior in capturing the latent semantics of complex relationship types. However, the convolutional model outperforms 44% of the true facts and achieves a 3% improvement in results compared to other models. Research limitations/implications Despite the success of embedding models to enrich D3FEND using link prediction under the supervised learning setup, it has some limitations, such as not capturing diversity and hierarchies of relations. The average node degree of D3FEND KG is 16.85, with 12% of entities having a node degree less than 2, especially there are many entities or relations with few or no observed links. This results in sparsity and data imbalance, which affect the model performance even after increasing the embedding vector size. Moreover, KG embedding models consider existing entities and relations and may not incorporate external or contextual information such as textual descriptions, temporal dynamics or domain knowledge, which can enhance the link prediction performance. Practical implications Link prediction in the D3FEND KG can benefit cybersecurity countermeasure strategies in several ways, such as it can help to identify gaps or weaknesses in the existing defensive methods and suggest possible ways to improve or augment them; it can help to compare and contrast different defensive methods and understand their trade-offs and synergies; it can help to discover novel or emerging defensive methods by inferring new relations from existing data or external sources; and it can help to generate recommendations or guidance for selecting or deploying appropriate defensive methods based on the characteristics and objectives of the system or network. Originality/value The representation learning approach helps to reduce incompleteness using a link prediction that infers possible missing facts by using the existing entities and relations of D3FEND.

show abstract

Recent Progress of Using Knowledge Graph for Cybersecurity

Cited by 31 publications

References 90 publications

Knowledge mining of unstructured information: application to cyber domain

Knowledge mining of unstructured information: application to cyber domain

Development and Analysis of a Reconnaissance-Technique Knowledge Graph

Infer the missing facts of D3FEND using knowledge graph representation learning

Contact Info

Product

Resources

About