Abstract:Security organizations increasingly rely on Cyber Threat Intelligence (CTI) sharing to enhance resilience against cyber threats. However, its effectiveness remains dubious due to two major limitations: first, the existing approaches fail to identify the unseen types of Indicator of compromise (IOC); second, they are incapable of automatically generating categorized CTIs with domain tags (e.g., finance, government), which makes CTI sharing ineffective. To combat the challenges, this paper proposes TIMiner, a novel automated framework for CTI extraction and sharing based on social media data. Particularly, an efficient domain recognizer based on convolutional neural network is first implemented to identify CTIs' targeted domain. Then, an indicator of compromise (IOC) extraction approach based on word embedding and syntactic dependence is proposed, which provides the ability to identify unseen types of IOCs. Finally, the extracted IOC and its domain tag are integrated to generate a categorized CTI with specific-domain. TIMiner is capable of generating CTIs with domain tags automatically. With the categorized CTIs, Threat-Index is presented to quantify the severity of the threats toward different domains. Experimental results confirm that the proposed CTI domain recognizer and IOC extraction achieve superior performance with the accuracy exceeding 84% and 94%, respectively. Moreover, TIMiner stimulates new insights on the evolution of cyber attacks across multiple domains.

Indicator Autogeneration of Compromise Oriented to Threat Intelligence

Text Classification and Threat Intelligence Generation for Industrial Control System Security

Key Requirements for the Detection and Sharing of Behavioral Indicators of Compromise

Automatic Generation of Malware Threat Intelligence from Unstructured Malware Traces

TIMiner: Automatically extracting and analyzing categorized cyber threat intelligence from social data

A System for Automated Open-Source Threat Intelligence Gathering and Management

Enhancing Cyber-Threat Intelligence in the Arab World: Leveraging IoC and MISP Integration

ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management

Open Source Intelligence for Malicious Behavior Discovery and Interpretation

Taxonomy driven indicator scoring in MISP threat intelligence platforms

Distributed Shielded Execution for Transmissible Cyber Threats Analysis

Explainable artificial intelligence envisioned security mechanism for cyber threat hunting

Towards Automated Threat Intelligence Fusion

ThreatKG: A Threat Knowledge Graph for Automated Open-Source Cyber Threat Intelligence Gathering and Management

A Trusted Edge Computing System Based on Intelligent Risk Detection for Smart IoT

Trusted Edge Computing System Based on Intelligent Risk Detection for Smart IoT

A Blackboard Sharing Mechanism for Community Cyber Threat Intelligence Based on Multi-Agent System.

Integration of Cyber Threat Intelligence into Security Onion and Malcolm for the use case of industrial networks

Improving IIoT security: Unveiling threats through advanced side-channel analysis

Collecting Indicators of Compromise from Unstructured Text of Cybersecurity Articles using Neural-Based Sequence Labelling

Understanding Indicators of Compromise against Cyber-Attacks in Industrial Control Systems: A Security Perspective