STIX-based Network Security Knowledge Graph Ontology Modeling Method

Liu, Zhengjun; Sun, Zhi Ren; Chen, Jianfeng; Zhou, Yujin; Yang, Tao; Yang, Hui; Liu, Jie

doi:10.1145/3397056.3397083

Cited by 11 publications

(7 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another industry standard, STIX™ (Structured Threat Information Expression), is a language and serialization format that can be used in ontological modeling of cybersecurity knowledge graphs [29].…”

Section: Knowledge Graph-based Koses For Cybersecurity Applicationsmentioning

confidence: 99%

“…-Semantic graph databases, including RDF triplestores and quadstores: Allegrograph, 2 Amazon Neptune, 3 AnzoGraph DB, 4 CRAY Graph Engine 5 , Dgraph, 6 GraphDB, 7 MarkLogic, 8 Openlink Virtuoso, 9 RDFox, 10 Stardog 11 -Property graph databases: MEMGraph, 12 NebulaGraph, 13 Neo4j, 14 RedisGraph, 15 TigerGraph, 16 Trovares 17 -Multi-model graph databases: AgensGraph, 18 ArangoDB, 19 DataStax, 20 FlockDB, 21 graphbase.ai, 22 HyperGraphDB, 23 JanusGraph, 24 Microsoft Azure Cosmos DB, 25 Oracle Spatial and Graph, 26 OrientDB, 27 SAP HANA, 28 Sparksee, 29 TerminusDB, 30 TypeDB 31…”

Section: Introduction To Cybersecurity Knowledge Graphsmentioning

confidence: 99%

See 1 more Smart Citation

Cybersecurity knowledge graphs

Sikos

2023

Knowl Inf Syst

View full text Add to dashboard Cite

Cybersecurity knowledge graphs, which represent cyber-knowledge with a graph-based data model, provide holistic approaches for processing massive volumes of complex cybersecurity data derived from diverse sources. They can assist security analysts to obtain cyberthreat intelligence, achieve a high level of cyber-situational awareness, discover new cyber-knowledge, visualize networks, data flow, and attack paths, and understand data correlations by aggregating and fusing data. This paper reviews the most prominent graph-based data models used in this domain, along with knowledge organization systems that define concepts and properties utilized in formal cyber-knowledge representation for both background knowledge and specific expert knowledge about an actual system or attack. It is also discussed how cybersecurity knowledge graphs enable machine learning and facilitate automated reasoning over cyber-knowledge.

show abstract

Section: Knowledge Graph-based Koses For Cybersecurity Applicationsmentioning

confidence: 99%

Section: Introduction To Cybersecurity Knowledge Graphsmentioning

confidence: 99%

Cybersecurity knowledge graphs

Sikos

2023

Knowl Inf Syst

View full text Add to dashboard Cite

show abstract

“…STIX is used as a serialization format to exchange CTI, and it is one of the most widely used threat intelligence sharing languages [31]. STIX can describe various characteristics of threat intelligence, such as threat signatures, threat activities, and security incidents.…”

Section: Threat Intelligence Sharing Standards and Platformsmentioning

confidence: 99%

An Automatic Assessment Method of Cyber Threat Intelligence Combined with ATT&CK Matrix

Zhang

Chen

Bai

et al. 2022

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

With the occurrence of cyber security incidents, the value of threat intelligence is coming to the fore. Timely extracting Indicator of Compromise (IOC) from cyber threat intelligence can quickly respond to threats. However, the sparse text in public threat intelligence scatters useful information, which makes it challenging to assess unstructured threat intelligence. In this paper, we proposed Cyber Threat Intelligence Automated Assessment Model (TIAM), a method to automatically assess highly sparse threat intelligence from multiple dimensions. TIAM implemented automatic classification of threat intelligence based on feature extraction, defined assessment criteria to quantify the value of threat intelligence, and combined ATT&CK to identify attack techniques related to IOC. Finally, we associated the identified IOCs, ATT&CK techniques, and intelligence quantification results. The experimental results shown that TIAM could better assess threat intelligence and help security managers to obtain valuable cyber threat intelligence.

show abstract

“…However, due to the use of STIX 1.0, which is seen as an obstacle to sharing information about cyber threats, this ontology has a weakness in semantic expression [35]. In [36], a method was proposed to model a knowledge graph ontology based on STIX. This method generates an ontology schema by classifying the concepts in the network security field with low redundancy and a strong structural hierarchy.…”

Section: Threat Ontology Constructionmentioning

confidence: 99%

Multiontology Construction and Application of Threat Model Based on Adversarial Attack and Defense Under ISO/IEC 27032

Cheng

Chen

et al. 2022

IEEE Access

View full text Add to dashboard Cite

Research pertaining to threat modeling is significant. However, the existing threat modeling methods suffer from ambiguity, heterogeneity and incompleteness; furthermore, the threat models at different abstraction levels are separated from each other, and the model elements are fragmented. In the knowledge engineering community, an ontology is an explicit specification of a conceptualization. Introducing the ontology method into the study of threat models is an effective way to solve the above problems. This paper creates a multiontology framework for the threat model of information systems (IS) based on domain knowledge (attack and defense knowledge), engineering experience, and industry standards (ISO/IEC 27032). The multiontology framework includes a generalized ontology (GO), a domain ontology (DO), and an application ontology (AO). This paper builds the ontology of each layer and ultimately presents case studies. The results show that the multiontology threat model based on adversarial attack and defense effectively solves the above problems of the existing threat modeling methods. In addition, systematic threat modeling using the multiontology method can be used not only for attack pathbased threat analysis but also for adversarial attack and defense-based threat analysis. This method can help detect security issues and effectively guide security personnel.

show abstract

STIX-based Network Security Knowledge Graph Ontology Modeling Method

Cited by 11 publications

References 3 publications

Cybersecurity knowledge graphs

Cybersecurity knowledge graphs

An Automatic Assessment Method of Cyber Threat Intelligence Combined with ATT&CK Matrix

Multiontology Construction and Application of Threat Model Based on Adversarial Attack and Defense Under ISO/IEC 27032

Contact Info

Product

Resources

About