Abstract:Cyber attacks have become increasingly complicated, persistent, organized, and weaponized. Faces with this situation, drives a rising number of organizations across the world are showing a growing willingness to leverage the open exchange of cyber threat intelligence (CTI) for obtaining a full picture of the fast-evolving cyber threat situation and protecting themselves against cyber-attacks. However, modeling CTI is challenging due to the explicit and implicit relationships among CTI and the heterogeneity of cyber-threat infrastructure nodes involved in CTI. Owing to the limited labels of cyber threat infrastructure nodes involved in CTI, automatically identifying the threat type of infrastructure nodes for early warning is also challenging. To tackle these challenges, a practical system called HinCTI is developed for modeling cyber threat intelligence and identifying threat types. We first design a threat intelligence meta-schema to depict the semantic relatedness of infrastructure nodes. We then model cyber threat intelligence on heterogeneous information network (HIN), which can integrate various types of infrastructure nodes and rich relations among them. Following, we define a meta-path and meta-graph instances-based threat Infrastructure similarity (MIIS) measure between threat infrastructure nodes and present a MIIS measure-based heterogeneous graph convolutional network (GCN) approach to identify the threat types of infrastructure nodes involved in CTI. Moreover, through the hierarchical regularization strategy, our model can alleviate the problem of overfitting and achieve good results in the threat type identification of infrastructure nodes. To the best of our knowledge, this work is the first to model CTI on HIN for threat identification and propose a heterogeneous GCN-based approach for threat type identification of infrastructure nodes. With HinCTI, comprehensive experiments are conducted on real-world datasets, and experimental results demonstrate that our proposed approach can significantly improve the performance of threat type identification compared to the existing state-of-the-art baseline methods. Our work is beneficial to greatly relieve security analysts from heavy analysis work and efficiently protect organizations against cyber-attacks.

TIMFuser: A Multi-granular fusion framework for cyber threat intelligence

Towards Automated Threat Intelligence Fusion

TIMiner: Automatically extracting and analyzing categorized cyber threat intelligence from social data

A Framework for Threat Intelligence Extraction and Fusion

A Comprehensive Dynamic Quality Assessment Method for Cyber Threat Intelligence

Attack Scenario Reconstruction Via Fusing Heterogeneous Threat Intelligence

MIF: A multi-step attack scenario reconstruction and attack chains extraction method based on multi-information fusion

IntelEX: A LLM-driven Attack-level Threat Intelligence Extraction Framework

TIM: threat context-enhanced TTP intelligence mining on unstructured threat data

TSTEM: A Cognitive Platform for Collecting Cyber Threat Intelligence in the Wild

An Automated Dynamic Quality Assessment Method for Cyber Threat Intelligence

Automatic Generation of Malware Threat Intelligence from Unstructured Malware Traces

HeteMSD: A Big Data Analytics Framework for Targeted Cyber-Attacks Detection Using Heterogeneous Multisource Data

HinCTI: A Cyber Threat Intelligence Modeling and Identification System Based on Heterogeneous Information Network

What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey

Attack Behavior Extraction Based on Heterogeneous Cyberthreat Intelligence and Graph Convolutional Networks

MultiKG: Multi-Source Threat Intelligence Aggregation for High-Quality Knowledge Graph Representation of Attack Techniques

Early Detection of Fileless Attacks Based on Multi-Feature Fusion of Complex Attack Vectors

Nip in the Bud: Forecasting and Interpreting Post-exploitation Attacks in Real-time through Cyber Threat Intelligence Reports

APT-MMF: An advanced persistent threat actor attribution method based on multimodal and multilevel feature fusion

TINKER: A framework for Open source Cyberthreat Intelligence