Abstract:In our interconnected world, cyber threats continuously evolve, presenting unprecedented challenges to cybersecurity. Conventional methods such as anomaly‐based and feature‐based approaches are encountering limitations and proving inadequate. The utilization of knowledge graph reasoning, leveraging graph structures, emerges as a promising paradigm shift in the landscape of cyberattack detection. This scholarly work delves into contemporary cybersecurity research, examining the potential of knowledge graph reasoning and proposing an innovative methodology with three principal objectives: optimizing data preparation for knowledge graph embedding models, establishing semantic foundations for network analysis via the system state graph ontology, and elevating network attack recognition through knowledge graph inference techniques. The study conducts experiments, comparing the proposed approach against existing methodologies, and demonstrates its efficacy in addressing the challenges associated with the escalating volume of network data. This approach signifies a promising trajectory towards automating network attack recognition and fortifying network security by seamlessly integrating knowledge graphs. In today's digital landscape, cybercriminals are constantly evolving their tactics, making it challenging for traditional cybersecurity methods to keep up. To address this issue, this study explores the potential of knowledge graph reasoning as a more adaptable and sophisticated approach to identify and counter network attacks. By leveraging graph structures imbued with human‐like thinking, this method enhances the resilience of cybersecurity systems. The study focuses on three critical aspects: data preparation, semantic foundations, and knowledge graph inference techniques. Through an in‐depth analysis of these components, the research aims to reveal how knowledge graph reasoning can improve cyberattack detection and enhance the overall efficacy of cybersecurity measures, including intrusion detection systems. The proposed approach has undergone extensive experimentation to validate its effectiveness compared to existing methods. The results of the experiment have shown a remarkable advancement in accuracy, speed, and recall for recognition, surpassing current methods. This achievement is a notable contribution in the realm of managing big data in cybersecurity. The study establishes a foundation for the automation of network attack detection, ultimately enhancing overall network security.

CSKG4APT: A Cybersecurity Knowledge Graph for Advanced Persistent Threat Organization Attribution

APTKG: Constructing Threat Intelligence Knowledge Graph from Open-Source APT Reports Based on Deep Learning

K-CTIAA: Automatic Analysis of Cyber Threat Intelligence Based on a Knowledge Graph

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

A System for Automated Open-Source Threat Intelligence Gathering and Management

Recent Progress of Using Knowledge Graph for Cybersecurity

APT-KGL: an Intelligent APT Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning

SecTKG: A Knowledge Graph for Open-Source Security Tools.

AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports

ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management

IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data

Advanced Persistent Threat intelligent profiling technique: A survey

Combating Advanced Persistent Threats: Challenges and Solutions

Knowledge graph reasoning for cyber attack detection

MultiKG: Multi-Source Threat Intelligence Aggregation for High-Quality Knowledge Graph Representation of Attack Techniques

A Comprehensive Survey of Advanced Persistent Threat Attribution: Taxonomy, Methods, Challenges and Open Research Problems

KnowCTI: Knowledge-based Cyber threat intelligence entity and relation extraction

Data-Driven Cybersecurity Knowledge Graph Construction for Industrial Control System Security

ATT&CK-based Advanced Persistent Threat attacks risk propagation assessment model for zero trust networks

Chasing the Shadows: TTPs in Action to Attribute Advanced Persistent Threats

AttacKG+:Boosting Attack Knowledge Graph Construction with Large Language Models