Abstract:Open-source cyber threat intelligence (OSCTI) is becoming more influential in obtaining current network security information. Most studies on cyber threat intelligence (CTI) focus on automating the extraction of threat entities from public sources that describe attack events. The cybersecurity knowledge graph aims to change the expression of threat knowledge so that security researchers can accurately and efficiently obtain various types of threat information for preliminary intelligent decisions. The attribution technology can not only assist security analysts in detecting advanced persistent threats, but can also identify the same threat from different attack events. Therefore, it is important to trace the attack threat actor. In this study, we used the knowledge graph technology, considered the latest research on cyber threat attack attribution, and thoroughly examined key related technologies and theories in the process of constructing and applying the advanced persistent threat (APT) knowledge graph from OSCTI. We designed a cybersecurity platform named CSKG4APT based on a knowledge graph. Inspired by the theory of ontology, we constructed CSKG4APT as an APT knowledge graph model based on real APT attack scenarios. We then designed an APT threat knowledge extraction algorithm for completing and updating the knowledge graph using deep learning and expert knowledge. Finally, we proposed a practical APT attack attribution method with attribution and countermeasures. CSKG4APT is not a passive defense method in traditional network confrontation but one that integrates a large amount of fragmented intelligence and can actively adjust its defense strategy. It lays the foundation for further dominance in network attack and defense.

APTKG: Constructing Threat Intelligence Knowledge Graph from Open-Source APT Reports Based on Deep Learning

AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports

K-CTIAA: Automatic Analysis of Cyber Threat Intelligence Based on a Knowledge Graph

CSKG4APT: A Cybersecurity Knowledge Graph for Advanced Persistent Threat Organization Attribution

MultiKG: Multi-Source Threat Intelligence Aggregation for High-Quality Knowledge Graph Representation of Attack Techniques

APT-KGL: an Intelligent APT Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning

KnowCTI: Knowledge-based Cyber threat intelligence entity and relation extraction

LLM-TIKG: Threat intelligence knowledge graph construction utilizing large language model

ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management

Actionable Cyber Threat Intelligence using Knowledge Graphs and Large Language Models

A System for Automated Open-Source Threat Intelligence Gathering and Management

CTINEXUS: Leveraging Optimized LLM In-Context Learning for Constructing Cybersecurity Knowledge Graphs Under Data Scarcity

SecTKG: A Knowledge Graph for Open-Source Security Tools.

AttacKG+:Boosting Attack Knowledge Graph Construction with Large Language Models

CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports

Advanced Persistent Threat intelligent profiling technique: A survey

AttacKG+: Boosting Attack Graph Construction with Large Language Models

KGV: Integrating Large Language Models with Knowledge Graphs for Cyber Threat Intelligence Credibility Assessment

Recent Progress of Using Knowledge Graph for Cybersecurity

AISLE: Self-supervised Representation Learning for the Investigation of Advanced Persistent Threat

A Novel Threat Intelligence Information Extraction System Combining Multiple Models