IEEE Access Journal

Creating Cybersecurity Knowledge Graphs from Malware After Action Reports

Aritran Piplai, Sudip Mittal, Anupam Joshi, Tim Finin, James Holt, and Richard Zak

December 1, 2020

After Action Reports (AARs) provide incisive analysis of cyber-incidents. Extracting cyber-knowledge from these sources would provide security analysts with credible information, which they can use to detect or find patterns indicative of a cyber-attack. In this paper, we describe a system to extract information from AARs, aggregate the extracted information by fusing similar entities together, and represent that extracted information in a Cybersecurity Knowledge Graph (CKG). We extract entities by building a customized named entity recognizer called `Malware Entity Extractor' (MEE). We then build a neural network to predict how pairs of `malware entities' are related to each other. When we have predicted entity pairs and the relationship between them, we assert the `entity-relationship set' in a CKG. Our next step in the process is to fuse similar entities to improve our CKG. This fusion helps represent intelligence extracted from multiple documents and reports. The fused CKG has knowledge from multiple AARs, with relationships between entities extracted from separate reports. As a result of this fusion, a security analyst can execute queries and retrieve better answers on the fused CKG, than a knowledge graph with no fusion. We also showcase various reasoning capabilities that can be leveraged by a security analyst using our fused CKG.

BibTeX OWL Tweet Scholar

Tags: after action reports, ai, artificial intelligence, computer security, cyber threat intelligence, cybersecurity, knowledge graphs, natural language processing, natural language processing, owl, rdf, semantic web

Type: Article

Publisher: IEEE

Volume: 8

Note: DOI: 10.1109/ACCESS.2020.3039234

Downloads: 1134 downloads