Abstract:Cyber attacks have become increasingly complicated, persistent, organized, and weaponized. Faces with this situation, drives a rising number of organizations across the world are showing a growing willingness to leverage the open exchange of cyber threat intelligence (CTI) for obtaining a full picture of the fast-evolving cyber threat situation and protecting themselves against cyber-attacks. However, modeling CTI is challenging due to the explicit and implicit relationships among CTI and the heterogeneity of cyber-threat infrastructure nodes involved in CTI. Owing to the limited labels of cyber threat infrastructure nodes involved in CTI, automatically identifying the threat type of infrastructure nodes for early warning is also challenging. To tackle these challenges, a practical system called HinCTI is developed for modeling cyber threat intelligence and identifying threat types. We first design a threat intelligence meta-schema to depict the semantic relatedness of infrastructure nodes. We then model cyber threat intelligence on heterogeneous information network (HIN), which can integrate various types of infrastructure nodes and rich relations among them. Following, we define a meta-path and meta-graph instances-based threat Infrastructure similarity (MIIS) measure between threat infrastructure nodes and present a MIIS measure-based heterogeneous graph convolutional network (GCN) approach to identify the threat types of infrastructure nodes involved in CTI. Moreover, through the hierarchical regularization strategy, our model can alleviate the problem of overfitting and achieve good results in the threat type identification of infrastructure nodes. To the best of our knowledge, this work is the first to model CTI on HIN for threat identification and propose a heterogeneous GCN-based approach for threat type identification of infrastructure nodes. With HinCTI, comprehensive experiments are conducted on real-world datasets, and experimental results demonstrate that our proposed approach can significantly improve the performance of threat type identification compared to the existing state-of-the-art baseline methods. Our work is beneficial to greatly relieve security analysts from heavy analysis work and efficiently protect organizations against cyber-attacks.

Cyberthreat-Intelligence Information Sharing: Enhancing Collaborative Security.

A Comprehensive Dynamic Quality Assessment Method for Cyber Threat Intelligence

Towards Cyber Threat Intelligence for the IoT

A Cyber Threat Intelligence Management Platform for Industrial Environments

An Automated Dynamic Quality Assessment Method for Cyber Threat Intelligence

Overview of the Technologies of Threat Intelligence Sensing, Sharing and Analysis in Cyber Space

Challenges and Opportunities of Blockchain for Cyber Threat Intelligence Sharing

A Blackboard Sharing Mechanism for Community Cyber Threat Intelligence Based on Multi-Agent System.

A Cloud-Edge Based Data Security Architecture for Sharing and Analysing Cyber Threat Information.

SeCTIS: A Framework to Secure CTI Sharing

Enabling Privacy-Preserving Sharing of Cyber Threat Information in the Cloud

Blockchain-Based Cyber Threat Intelligence System Architecture for Sustainable Computing

Collaborative Threat Intelligence: Enhancing IoT Security Through Blockchain and Machine Learning Integration

Combining Threat Intelligence with IoT Scanning to Predict Cyber Attack

A Blockchain-Enabled Incentivised Framework for Cyber Threat Intelligence Sharing in ICS

A Trusted, Verifiable and Differential Cyber Threat Intelligence Sharing Framework using Blockchain

TIMiner: Automatically extracting and analyzing categorized cyber threat intelligence from social data

K-CTIAA: Automatic Analysis of Cyber Threat Intelligence Based on a Knowledge Graph

NLP-Based Techniques for Cyber Threat Intelligence

HinCTI: A Cyber Threat Intelligence Modeling and Identification System Based on Heterogeneous Information Network