Abstract:Threat analysis relies on knowledge bases that contain a large number of security entities.The scope and impact of security threats and risks are evaluated by modeling threat sources, attack capabilities, attack motivations, and threat paths, taking into consideration the vulnerability of assets in the system and the security measures implemented.However, the lack of entity relations between these knowledge bases hinders the security event tracking and attack path generation.To complement entity relations between CAPEC and ATT＆amp;CK techniques and enrich threat paths, an entity correlation prediction method called WGS was proposed, in which entity descriptions were analyzed based on word embedding and a graph convolution network.A Word2Vec model was trained in the proposed method for security domain to extract domain-specific semantic features and a GCN model to capture the co-occurrence between words and sentences in entity descriptions.The relationship between entities was predicted by a Siamese network that combines these two features.The inclusion of external semantic information helped address the few-shot learning problem caused by limited entity relations in the existing knowledge base.Additionally, dynamic negative sampling and regularization was applied in model training.Experiments conducted on CAPEC and ATT＆amp;CK database provided by MITRE demonstrate that WGS effectively separates related entity pairs from irrelevant ones in the sample space and accurately predicts new entity relations.The proposed method achieves higher prediction accuracy in few-shot learning and requires shorter training time and less computing resources compared to the Bert-based text similarity prediction models.It proves that word embedding and graph convolutional network based entity relation prediction method can extract new entity correlation relationships between attack patterns and techniques.This helps to abstract attack techniques and tactics from low-level vulnerabilities and weaknesses in security threat analysis.

Intrusion Alerts Correlation Model Based on XSWRL Ontology

The Research of Alert Correlation Based on Attack Intetion

Discovering Attack Scenarios Via Intrusion Alert Correlation Using Graph Convolutional Networks

A Learning Framework for Transitioning Network Intrusion Alerts Management System to Ontology

An Alert Hierarchical Association Algorithm To Construct Attack Scenarios

An Intrusion Alert Correlation Model Based on Data Mining

A Hierarchical Security Events Correlation Model for Real-time Cyber Threat Detection and Response

Correlating Intrusion Alerts Into Attack Scenarios Based On Improved Evolving Self-Organizing Maps

Information Security Ontology Model for Internet of Thing

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

Hierarchical Distributed Alert Correlation Model

Survey of alert-correlation based on network threat detection techniques

OntoCSD: an ontology-based security model for an integrated solution of cyberspace defense

Design and Implementation of Alert Information Correlation Model

An alert correlating algorithm based on multi-step attack path graphs:MSACA

Alerts Information Association Analysis Technology Based on Intrusion Intention

Alert Correlation Based on Description Logics

Attack Scenario Detection Based on Expert System

Predicting Correlation Relationships of Entities Between Attack Patterns and Techniques Based on Word Embedding and Graph Convolutional Network

Learning And Applying Ontology For Machine Learning In Cyber Attack Detection

An Effective Attack Scenario Construction Model based on Attack Steps and Stages Identification