Abstract:Open-source cyber threat intelligence (OSCTI) is becoming more influential in obtaining current network security information. Most studies on cyber threat intelligence (CTI) focus on automating the extraction of threat entities from public sources that describe attack events. The cybersecurity knowledge graph aims to change the expression of threat knowledge so that security researchers can accurately and efficiently obtain various types of threat information for preliminary intelligent decisions. The attribution technology can not only assist security analysts in detecting advanced persistent threats, but can also identify the same threat from different attack events. Therefore, it is important to trace the attack threat actor. In this study, we used the knowledge graph technology, considered the latest research on cyber threat attack attribution, and thoroughly examined key related technologies and theories in the process of constructing and applying the advanced persistent threat (APT) knowledge graph from OSCTI. We designed a cybersecurity platform named CSKG4APT based on a knowledge graph. Inspired by the theory of ontology, we constructed CSKG4APT as an APT knowledge graph model based on real APT attack scenarios. We then designed an APT threat knowledge extraction algorithm for completing and updating the knowledge graph using deep learning and expert knowledge. Finally, we proposed a practical APT attack attribution method with attribution and countermeasures. CSKG4APT is not a passive defense method in traditional network confrontation but one that integrates a large amount of fragmented intelligence and can actively adjust its defense strategy. It lays the foundation for further dominance in network attack and defense.

Important Member Discovery of Attribution Trace Based on Relevant Circle (Short Paper).

NetworkTrace: Probabilistic Relevant Pattern Recognition Approach to Attribution Trace Analysis

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

A Directed Acyclic Graph Based Detection for Rbac Based Secure Interoperation

Community Discovery of Attribution Trace Based on Deep Learning Approach.

Correlation of Centralities: A Study Through Distinct Graph Robustness

CORRELATION ANALYSIS OF ATTACK STRATEGIESAND ROBUSTNESS ANALYSIS ON THREE NETWORK MODELS

TRACEGADGET: Detecting and Tracing Network Level Attack Through Federal Provenance Graph

Dynamic core detection in social network analysis

IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data

CSKG4APT: A Cybersecurity Knowledge Graph for Advanced Persistent Threat Organization Attribution

Attacker Traceability on Ethereum Through Graph Analysis.

Coordinated Web Scan Detection Based on Hierarchical Correlation

Byzantine Attacker Identification in Collaborative Spectrum Sensing: A Robust Defense Framework

HiSec: Towards Cyber Threat Correlation and Discovery Based on Hierarchical Graph Neural Networks

A Multi-Attribute Decision-Making Approach for Critical Node Identification in Complex Networks

User identification in cyber-physical space: a case study on mobile query logs and trajectories.

Advanced Persistent Threat Group Correlation Analysis via Attack Behavior Patterns and Rough Sets

Seeing the Attack Paths: Improved Flow Correlation Scheme in Stepping-Stone Intrusion

Asynchronous Side Information Attack from the Edge: an Approach to Identify Participants from Anonymous Mobility Traces.

Research on a Critical Link Discovery Method for Network Security Situational Awareness