Open-CyKG: An Open Cyber Threat Intelligence Knowledge Graph
Instant analysis of cybersecurity reports is a fundamental challenge for security experts as an immeasurable amount of cyber information is generated on a daily basis, which necessitates automated information extraction tools to facilitate querying and retrieval of data. Hence, we present Open-CyKG: an Open Cyber Threat Intelligence (CTI) Knowledge Graph (KG) framework that is constructed using an attention-based neural Open Information Extraction (OIE) model to extract valuable cyber threat information from unstructured Advanced Persistent Threat (APT) reports. More specifically, we first identify relevant entities by developing a neural cybersecurity Named Entity Recognizer (NER) that aids in labeling relation triples generated by the OIE model. Afterward, the extracted structured data is canonicalized to build the KG by employing fusion techniques using word embeddings. As a result, security professionals can execute queries to retrieve valuable information from the Open-CyKG framework. Experimental results demonstrate that our proposed components that build up Open-CyKG outperform state-of-the-art models.
Code (1)
Tasks
Deep AttentionKnowledge GraphsNEROpen Information ExtractionRetrievalWord EmbeddingsSimilar Papers 제목 키워드 기반
TINKER: A framework for Open source Cyberthreat Intelligence
Threat intelligence on malware attacks and campaigns is increasingly being shared with other security experts for a cost or for free. Other security analysts use this intelligence to inform them of indicators of compromi…
Information RetrievalIntrusion DetectionKnowledge GraphsNamed Entity Recognition (NER)+1CyNER: A Python Library for Cybersecurity Named Entity Recognition
Open Cyber threat intelligence (OpenCTI) information is available in an unstructured format from heterogeneous sources on the Internet. We present CyNER, an open-source python library for cybersecurity named entity recog…
named-entity-recognitionNamed Entity RecognitionNamed Entity Recognition (NER)NERA System for Efficiently Hunting for Cyber Threats in Computer Systems Using Threat Intelligence
Log-based cyber threat hunting has emerged as an important solution to counter sophisticated cyber attacks. However, existing approaches require non-trivial efforts of manual query construction and have overlooked the ri…
Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligence
Log-based cyber threat hunting has emerged as an important solution to counter sophisticated attacks. However, existing approaches require non-trivial efforts of manual query construction and have overlooked the rich ext…
False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systems
Cyber Threat Intelligence (CTI) has emerged as a vital complementary approach that operates in the early phases of the cyber threat lifecycle. CTI involves collecting, processing, and analyzing threat data to provide a m…
Text Generation