Abstract:Open source intelligence is a powerful tool for cybersecurity analysts to gather information both for analysis of discovered vulnerabilities and for detecting novel cybersecurity threats and exploits. However the scale of information that is relevant for information security on the internet is always increasing, and is intractable for analysts to parse comprehensively. Therefore methods of condensing the available open source intelligence, and automatically developing connections between disparate sources of information, is incredibly valuable. In this research, we present a system which constructs a Neo4j graph database formed by shared connections between open source intelligence text including blogs, cybersecurity bulletins, news sites, antivirus scans, social media posts (e.g., Reddit and Twitter), and threat reports. These connections are comprised of possible indicators of compromise (e.g., IP addresses, domains, hashes, email addresses, phone numbers), information on known exploits and techniques (e.g., CVEs and MITRE ATT&CK Technique ID's), and potential sources of information on cybersecurity exploits such as twitter usernames. The construction of the database of potential IoCs is detailed, including the addition of machine learning and metadata which can be used for filtering of the data for a specific domain (for example a specific natural language) when needed. Examples of utilizing the graph database for querying connections between known malicious IoCs and open source intelligence documents, including threat reports, are shown. We show three specific examples of interesting connections found in the graph database; the connections to a known exploited CVE, a known malicious IP address, and a malware hash signature.

Predicting enterprise cyber incidents using social network analysis on the darkweb hacker forums

Mining user interaction patterns in the darkweb to predict enterprise cyber incidents

Event Evolution Model for Cybersecurity Event Mining in Tweet Streams

Predicting Cyber Events by Leveraging Hacker Sentiment

Predicting Organizational Cybersecurity Risk: A Deep Learning Approach

Cream Skimming the Underground: Identifying Relevant Information Points from Online Forums

Deep Learning Algorithm for Threat Detection in Hackers Forum (Deep Web)

Using Social Media to Understand Cyber Attack Behavior

Attacking Strategies and Temporal Analysis Involving Facebook Discussion Groups

A holistic and proactive approach to forecasting cyber threats

Crowdsourcing Cybersecurity: Cyber Attack Detection using Social Media

Structural Analysis of Criminal Network and Predicting Hidden Links using Machine Learning

Detecting cyber threats through social network analysis: short survey

2 SocialImpact : Bring Order to Online Underground Social Dynamics

Early warning signals for predicting cryptomarket vendor success using dark net forum networks

Cybersecurity Threat Hunting and Vulnerability Analysis Using a Neo4j Graph Database of Open Source Intelligence

A Probabilistic Generative Model for Mining Cybercriminal Networks from Online Social Media

Inferring Discussion Topics about Exploitation of Vulnerabilities from Underground Hacking Forums

Latent Text Mining for Cybercrime Forensics

Towards Automatic Discovery of Cybercrime Supply Chains

Forecasting Suspicious Account Activity at Large-Scale Online Service Providers