<?xml version="1.0"?>

<!DOCTYPE owl [
	<!ENTITY rdf "http://www.w3.org/1999/02/22-rdf-syntax-ns#">
	<!ENTITY rdfs "http://www.w3.org/2000/01/rdf-schema#">
	<!ENTITY xsd "http://www.w3.org/2001/XMLSchema#">
	<!ENTITY owl "http://www.w3.org/2002/07/owl#">
	<!ENTITY cc "http://web.resource.org/cc/#">
	<!ENTITY project "http://ebiquity.umbc.edu/ontology/project.owl#">
	<!ENTITY person "http://ebiquity.umbc.edu/ontology/person.owl#">
	<!ENTITY pub "http://ebiquity.umbc.edu/ontology/publication.owl#">
	<!ENTITY assert "http://ebiquity.umbc.edu/ontology/assertion.owl#">
]>

<!--

This ontology document is licensed under the Creative Commons
Attribution License. To view a copy of this license, visit
http://creativecommons.org/licenses/by/2.0/ or send a letter to
Creative Commons, 559 Nathan Abbott Way, Stanford, California
94305, USA.

-->

<rdf:RDF 
		xmlns:rdf = "&rdf;"
		xmlns:rdfs = "&rdfs;"
		xmlns:xsd = "&xsd;"
		xmlns:owl = "&owl;"
		xmlns:cc = "&cc;"
		xmlns:project = "&project;"
		xmlns:person = "&person;"
		xmlns:pub = "&pub;"
		xmlns:assert = "&assert;">
	<pub:Article rdf:about="http://ebiquity.umbc.edu/paper/html/id/872/Creating-Cybersecurity-Knowledge-Graphs-from-Malware-After-Action-Reports">
		<rdfs:label><![CDATA[Creating Cybersecurity Knowledge Graphs from Malware After Action Reports]]></rdfs:label>
		<pub:title><![CDATA[Creating Cybersecurity Knowledge Graphs from Malware After Action Reports]]></pub:title>
		<pub:publishedOn rdf:datatype="&xsd;dateTime">2020-12-01T00:00:00-05:00</pub:publishedOn>
		<pub:abstract><![CDATA[After-Action Reports (AARs) provide incisive analysis of cyber incidents. Extracting cyber knowledge from these sources would provide security analysts with credible information, which they can use to detect or find patterns indicative of a cyberattack. In this paper, we describe a system to extract information from AARs, aggregate the extracted information by fusing similar entities together, and represent that extracted information in a Cybersecurity Knowledge Graph (CKG). We extract entities by building a customized named entity recognizer called `Malware Entity Extractor' (MEE). We then build a neural network to predict how pairs of `malware entities' are related to each other. When we have predicted entity pairs and the relationship between them, we assert the `entity-relationship set' in a CKG. Our next step in the process is to fuse similar entities to improve our CKG. This fusion helps represent intelligence extracted from multiple documents and reports. The fused CKG has knowledge from multiple AARs, with relationships between entities extracted from separate reports. As a result of this fusion, a security analyst can execute queries and retrieve better answers on the fused CKG, than a knowledge graph with no fusion. We also showcase various reasoning capabilities that can be leveraged by a security analyst using our fused CKG.]]></pub:abstract>
		<pub:pages><![CDATA[211691 - 211703]]></pub:pages>
		<pub:note><![CDATA[DOI: <a href="https://doi.org/10.1109/ACCESS.2020.3039234">10.1109/ACCESS.2020.3039234</a>
<br/>
<img src="https://i.imgur.com/VQp5ca8.jpg" style='height: 90%; width: 90%; object-fit: contain; display: block; margin-left: auto; margin-right: auto;'>
<div style="text-align:center">FIGURE 5. Hellsing malware entities in the Cybersecurity Knowledge Graph.</div>]]></pub:note>
		<pub:volume><![CDATA[8]]></pub:volume>
		<pub:counter>1523</pub:counter>
		<pub:tag><![CDATA[after action reports]]></pub:tag>
		<pub:tag><![CDATA[ai]]></pub:tag>
		<pub:tag><![CDATA[artificial intelligence]]></pub:tag>
		<pub:tag><![CDATA[computer security]]></pub:tag>
		<pub:tag><![CDATA[cyber threat intelligence]]></pub:tag>
		<pub:tag><![CDATA[cybersecurity]]></pub:tag>
		<pub:tag><![CDATA[knowledge graphs]]></pub:tag>
		<pub:tag><![CDATA[natural language processing]]></pub:tag>
		<pub:tag><![CDATA[natural language processing]]></pub:tag>
		<pub:tag><![CDATA[owl]]></pub:tag>
		<pub:tag><![CDATA[rdf]]></pub:tag>
		<pub:tag><![CDATA[semantic web]]></pub:tag>
		<pub:booktitle><![CDATA[IEEE Access Journal]]></pub:booktitle>
		<pub:publisher><![CDATA[IEEE]]></pub:publisher>
		<pub:author>
			<rdf:List>
				<rdf:first>
					<person:Person rdf:about="http://ebiquity.umbc.edu/person/html/Anupam/Joshi"><person:name><![CDATA[Anupam Joshi]]></person:name><rdfs:label><![CDATA[Anupam Joshi]]></rdfs:label></person:Person>
				</rdf:first>
				<rdf:rest>					<rdf:List>
						<rdf:first>
							<person:Person rdf:about="http://ebiquity.umbc.edu/person/html/Tim/Finin"><person:name><![CDATA[Tim Finin]]></person:name><rdfs:label><![CDATA[Tim Finin]]></rdfs:label></person:Person>
						</rdf:first>
						<rdf:rest>							<rdf:List>
								<rdf:first>
									<person:Person rdf:about="http://ebiquity.umbc.edu/person/html/Sudip/Mittal"><person:name><![CDATA[Sudip Mittal]]></person:name><rdfs:label><![CDATA[Sudip Mittal]]></rdfs:label></person:Person>
								</rdf:first>
								<rdf:rest>									<rdf:List>
										<rdf:first>
											<person:Person rdf:about="http://ebiquity.umbc.edu/person/html/Aritran/Piplai"><person:name><![CDATA[Aritran Piplai]]></person:name><rdfs:label><![CDATA[Aritran Piplai]]></rdfs:label></person:Person>
										</rdf:first>
										<rdf:rest>											<rdf:List>
												<rdf:first>
													<person:Person rdf:about="http://ebiquity.umbc.edu/person/html/James/Holt"><person:name><![CDATA[James Holt]]></person:name><rdfs:label><![CDATA[James Holt]]></rdfs:label></person:Person>
												</rdf:first>
												<rdf:rest>													<rdf:List>
														<rdf:first>
															<person:Person rdf:about="http://ebiquity.umbc.edu/person/html/Richard/Zak"><person:name><![CDATA[Richard Zak]]></person:name><rdfs:label><![CDATA[Richard Zak]]></rdfs:label></person:Person>
														</rdf:first>
														<rdf:rest rdf:resource="&rdf;nil" />
													</rdf:List>
												</rdf:rest>
											</rdf:List>
										</rdf:rest>
									</rdf:List>
								</rdf:rest>
							</rdf:List>
						</rdf:rest>
					</rdf:List>
				</rdf:rest>
			</rdf:List>
		</pub:author>
		<pub:firstAuthor>
<person:Person rdf:about="http://ebiquity.umbc.edu/person/html/Anupam/Joshi"><person:name><![CDATA[Anupam Joshi]]></person:name><rdfs:label><![CDATA[Anupam Joshi]]></rdfs:label></person:Person>
		</pub:firstAuthor>
		<pub:softCopy><pub:SoftCopy>
			<pub:softCopyFormat><![CDATA[PDF Document]]></pub:softCopyFormat>
			<pub:softCopyURI><![CDATA[http://ebiquity.umbc.edu/get/a/publication/1059.pdf]]></pub:softCopyURI>
			<pub:softCopySize>1155937</pub:softCopySize>
			</pub:SoftCopy>
			</pub:softCopy>
	</pub:Article>

<rdf:Description rdf:about="">
	<cc:License rdf:resource="http://creativecommons.org/licenses/by/2.0/" />
</rdf:Description>

</rdf:RDF>
