Abstract:Attack knowledge graph construction seeks to convert textual cyber threat intelligence (CTI) reports into structured representations, portraying the evolutionary traces of cyber attacks. Even though previous research has proposed various methods to construct attack knowledge graphs, they generally suffer from limited generalization capability to diverse knowledge types as well as requirement of expertise in model design and tuning. Addressing these limitations, we seek to utilize Large Language Models (LLMs), which have achieved enormous success in a broad range of tasks given exceptional capabilities in both language understanding and zero-shot task fulfillment. Thus, we propose a fully automatic LLM-based framework to construct attack knowledge graphs named: AttacKG+. Our framework consists of four consecutive modules: rewriter, parser, identifier, and summarizer, each of which is implemented by instruction prompting and in-context learning empowered by LLMs. Furthermore, we upgrade the existing attack knowledge schema and propose a comprehensive version. We represent a cyber attack as a temporally unfolding event, each temporal step of which encapsulates three layers of representation, including behavior graph, MITRE TTP labels, and state summary. Extensive evaluation demonstrates that: 1) our formulation seamlessly satisfies the information needs in threat event analysis, 2) our construction framework is effective in faithfully and accurately extracting the information defined by AttacKG+, and 3) our attack graph directly benefits downstream security practices such as attack reconstruction. All the code and datasets will be released upon acceptance.

An Attack Knowledge Model Based on Object-Oriented Technology

A Reference Model And System Architecture For Database Firewall

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

An Object-Oriented Model for Expert Knowledge Representation

Research on an attack knowledge based enhanced at-tack tree model

Research on Classification of Attack Technologies

AttacKG+:Boosting Attack Knowledge Graph Construction with Large Language Models

A Model of APT Attack Defense Based on Cyber Threat Detection

Analysis and Research of Attack Model

Modeling Attack, Defense and Threat Trees and the Cyber Kill Chain, ATT&CK and STRIDE Frameworks as Blackboard Architecture Networks

Coordinated Attack Modeling Based on Attack Tree

A Reference Model for Database Security Proxy

An Active Cooperation Defense Model for Large Scale Network

AttacKG+: Boosting Attack Graph Construction with Large Language Models

MODELING ATTACK SCENARIO WITH CAPABILITY

Network Attack-Defense Simulation Training System Based on HLA

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Survey on Architectural Attacks: A Unified Classification and Attack Model

An Network Attack Modeling Method Based on MLL-AT

Model and design of the kernel of assembly knowledge base systems

A Stochastic Modeling of Coordinated Internal and External Attacks