Abstract:Black hat hackers use malicious exploits to circumvent security controls and take advantage of system vulnerabilities worldwide, costing the global economy over $450 billion annually. While many organizations are increasingly turning to cyber threat intelligence (CTI) to help prioritize their vulnerabilities, extant CTI processes are often criticized as being reactive to known exploits. One promising data source that can help develop proactive CTI is the vast and ever-evolving Dark Web. In this study, we adopted the computational design science paradigm to design a novel deep learning (DL)- based exploit-vulnerability attention deep structured semantic model (EVA-DSSM) that includes bidirectional processing and attention mechanisms to automatically link exploits from the Dark Web to vulnerabilities. We also devised a novel device vulnerability severity metric (DVSM) that incorporates the exploit post date and vulnerability severity to help cybersecurity professionals with their device prioritization and risk management efforts. We rigorously evaluated the EVA-DSSM against state-of-theart non-DL and DL-based methods for short text matching on 52,590 exploit-vulnerability linkages across four testbeds: web application, remote, local, and denial of service. Results of these evaluations indicate that the proposed EVA-DSSM achieves precision at 1 scores 20% - 41% higher than non-DL approaches and 4% - 10% higher than DL-based approaches. We demonstrated the EVA-DSSM’s and DVSM’s practical utility with two CTI case studies: openly accessible systems in the top eight U.S. hospitals and over 20,000 Supervisory Control and Data Acquisition (SCADA) systems worldwide. A complementary user evaluation of the case study results indicated that 45 cybersecurity professionals found the EVADSSM and DVSM results more useful for exploit-vulnerability linking and risk prioritization activities than those produced by prevailing approaches. Given the rising cost of cyberattacks, the EVA-DSSM and DVSM have important implications for analysts in security operations centers, incident response teams, and cybersecurity vendors.

Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approach

CVE2ATT&CK: BERT-Based Mapping of CVEs to MITRE ATT&CK Techniques

Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting

Cybersecurity Defenses: Exploration of CVE Types through Attack Descriptions

Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure.

A Relevance Model for Threat-Centric Ranking of Cybersecurity Vulnerabilities

Automated CVE Analysis for Threat Prioritization and Impact Prediction

V2W-BERT: A Framework for Effective Hierarchical Multiclass Classification of Software Vulnerabilities

CVE-driven Attack Technique Prediction with Semantic Information Extraction and a Domain-specific Language Model

Automated Mapping of CVE Vulnerability Records to MITRE CWE Weaknesses

Machine Learning Based Approach to Recommend MITRE ATT&CK Framework for Software Requirements and Design Specifications

Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix

Assessing MITRE ATT&CK Risk Using a Cyber-Security Culture Framework

How hard can it be? Quantifying MITRE attack campaigns with attack trees and cATM logic

VTT-LLM: Advancing Vulnerability-to-Tactic-and-Technique Mapping through Fine-Tuning of Large Language Model

Enhancing cybersecurity defenses: a multicriteria decision-making approach to MITRE ATT&CK mitigation strategy

MITRE ATT&CK: State of the Art and Way Forward

Linking Exploits from the Dark Web to Known Vulnerabilities for Proactive Cyber Threat Intelligence: An Attention-Based Deep Structured Semantic Model

Automated discovery and mapping ATT&CK tactics and techniques for unstructured cyber threat intelligence

Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports