Abstract:The continuous improvement of the cyber threat intelligence sharing mechanism provides new ideas to deal with Advanced Persistent dures (TTP) from Cyber Threat Intelligence (CTI) can facilitate APT actors??? profiling for an immediate response. However, it is difficult for traditional manual methods to analyze attack behaviors from cyber threat intelligence due to its heterogeneous nature. Based on the Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) of threat behavior description, this paper proposes a threat behavioral knowledge extraction framework that integrates Heterogeneous Text Network (HTN) and Graph Convolutional Network (GCN) to solve this issue. It leverages the hierarchical correlation relationships of attack techniques and tactics in the ATT&CK to construct a text network of heterogeneous cyber threat intelligence. With the help of the Bidirectional Encoder Representation from Transformers (BERT) pretraining model to analyze the contextual semantics of cyber threat intelligence, the task of threat behavior identification is transformed into a text classification task, which automatically extracts attack behavior in CTI, then identifies the malware and advanced threat actors. The experimental results show that F1 achieve 94.86% and 92.15% for the multi-label classification tasks of tactics and techniques. Extend the experiment to verify the method???s effectiveness in identifying the malware and threat actors in APT attacks. The F1 for malware and advanced threat actors identification task reached 98.45% and 99.48%, which are better than the benchmark model in the experiment and achieve state of the art. The model can effectively model threat intelligence text features with a priori knowledge to compensate for insufficient sample data and improve the classification performance and recognition ability of threat behavior in text.

A Cyber Threat Entity Recognition Method Based on Robust Feature Representation and Adversarial Training.

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

A Novel Feature Integration and Entity Boundary Detection for Named Entity Recognition in Cybersecurity

Multi-features based Semantic Augmentation Networks for Named Entity Recognition in Threat Intelligence

Adversarial Active Learning for Named Entity Recognition in Cybersecurity

Attack Behavior Extraction Based on Heterogeneous Cyberthreat Intelligence and Graph Convolutional Networks

A Cybersecurity Named Entity Recognition Model Based on Active Learning and Self-learning

SECURENET: Advancing Cybersecurity Knowledge Graphs with Multi-Feature Perceptrons and Hierarchical Adversarial W2NER

Reliable feature selection for adversarially robust cyber-attack detection

A Novel Threat Intelligence Information Extraction System Combining Multiple Models

The Named Entity Recognition of Chinese Cybersecurity Using an Active Learning Strategy

A Self-Attention-Based Approach for Named Entity Recognition in Cybersecurity

A Framework for Threat Intelligence Extraction and Fusion

Improved self-training-based distant label denoising method for cybersecurity entity extractions

A network security entity recognition method based on feature template and CNN-BiLSTM-CRF

A Study of Ensemble Feature Selection and Adversarial Training for Malicious User Detection

KnowCTI: Knowledge-based Cyber threat intelligence entity and relation extraction

Exploring Robust Features for Improving Adversarial Robustness

Named Entity Recognition Using BERT with Whole World Masking in Cybersecurity Domain

Proactive security defense: cyber threat intelligence modeling for connected autonomous vehicles