Abstract:Cyber attacks have become increasingly complicated, persistent, organized, and weaponized. Faces with this situation, drives a rising number of organizations across the world are showing a growing willingness to leverage the open exchange of cyber threat intelligence (CTI) for obtaining a full picture of the fast-evolving cyber threat situation and protecting themselves against cyber-attacks. However, modeling CTI is challenging due to the explicit and implicit relationships among CTI and the heterogeneity of cyber-threat infrastructure nodes involved in CTI. Owing to the limited labels of cyber threat infrastructure nodes involved in CTI, automatically identifying the threat type of infrastructure nodes for early warning is also challenging. To tackle these challenges, a practical system called HinCTI is developed for modeling cyber threat intelligence and identifying threat types. We first design a threat intelligence meta-schema to depict the semantic relatedness of infrastructure nodes. We then model cyber threat intelligence on heterogeneous information network (HIN), which can integrate various types of infrastructure nodes and rich relations among them. Following, we define a meta-path and meta-graph instances-based threat Infrastructure similarity (MIIS) measure between threat infrastructure nodes and present a MIIS measure-based heterogeneous graph convolutional network (GCN) approach to identify the threat types of infrastructure nodes involved in CTI. Moreover, through the hierarchical regularization strategy, our model can alleviate the problem of overfitting and achieve good results in the threat type identification of infrastructure nodes. To the best of our knowledge, this work is the first to model CTI on HIN for threat identification and propose a heterogeneous GCN-based approach for threat type identification of infrastructure nodes. With HinCTI, comprehensive experiments are conducted on real-world datasets, and experimental results demonstrate that our proposed approach can significantly improve the performance of threat type identification compared to the existing state-of-the-art baseline methods. Our work is beneficial to greatly relieve security analysts from heavy analysis work and efficiently protect organizations against cyber-attacks.

A Comprehensive Dynamic Quality Assessment Method for Cyber Threat Intelligence

An Automated Dynamic Quality Assessment Method for Cyber Threat Intelligence

K-CTIAA: Automatic Analysis of Cyber Threat Intelligence Based on a Knowledge Graph

Cyberthreat-Intelligence Information Sharing: Enhancing Collaborative Security.

Cyber Threat Indicators Association Prediction Based on Weighted Fusion of Semantic and Topological Information.

TIMiner: Automatically extracting and analyzing categorized cyber threat intelligence from social data

AITI - An Automatic Identification Model of Threat Intelligence Based on Convolutional Neural Network.

A Research and Analysis Method of Open Source Threat Intelligence Data.

Blockchain-Based Cyber Threat Intelligence System Architecture for Sustainable Computing

HinCTI: A Cyber Threat Intelligence Modeling and Identification System Based on Heterogeneous Information Network

Graph Mining-based Trust Evaluation Mechanism with Multidimensional Features for Large-scale Heterogeneous Threat Intelligence.

Automated discovery and mapping ATT&CK tactics and techniques for unstructured cyber threat intelligence

Investigating the Temporal Dynamics of Cyber Threat Intelligence

A Blackboard Sharing Mechanism for Community Cyber Threat Intelligence Based on Multi-Agent System.

KGV: Integrating Large Language Models with Knowledge Graphs for Cyber Threat Intelligence Credibility Assessment

ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management

Cyber Threat Predictive Analytics for Improving Cyber Supply Chain Security

Proactive security defense: cyber threat intelligence modeling for connected autonomous vehicles

TIMFuser: A Multi-granular fusion framework for cyber threat intelligence

MTIV: A Trustworthiness Determination Approach for Threat Intelligence.

A Model-Data Integrated Cyber Security Risk Assessment Method for Industrial Control Systems