An Automatic Generation Approach of the Cyber Threat Intelligence Records Based on Multi-Source Information Fusion

Abstract

With the progressive deterioration of cyber threats, collecting cyber threat intelligence (CTI) from open-source threat intelligence publishing platforms (OSTIPs) can help information security personnel grasp public opinions with specific pertinence, handle emergency events, and even confront the advanced persistent threats. However, due to the explosive growth of information shared on multi-type OSTIPs, manually collecting the CTI has had low efficiency. Articles published on the OSTIPs are unstructured, leading to an imperative challenge to automatically gather CTI records only through natural language processing (NLP) methods. To remedy these limitations, this paper proposes an automatic approach to generate the CTI records based on multi-type OSTIPs (GCO), combing the NLP method, machine learning method, and cybersecurity threat intelligence knowledge. The experiment results demonstrate that the proposed GCO outperformed some state-of-the-art approaches on article classification and cybersecurity intelligence details (CSIs) extraction, with accuracy, precision, and recall all over 93%; finally, the generated records in the Neo4j-based CTI database can help reveal malicious threat groups.

Implementation of Network Data Mining Algorithm for Associated Users Based on Multi-Information Fusion

“…AUMA-MRL user extraction algorithm proposed in this paper can be implemented well when different networks overlap [23,24]. User interactions between new network nodes improve the power of network user interaction mining algorithms [25].…”

Using machine learning and topic modeling to examine manifestos of violent attackers.

“…Given these challenges, text mining approaches have been introduced, with topic modeling emerging as a prevalent method for uncovering underlying patterns in large text data sets (Vayansky & Kumar, 2020). Established techniques have found applications in forensics, particularly in cybersecurity, social media analysis, and author verification (Bérubé et al, 2020; Dutta et al, 2020; Shahbazi & Byun, 2022; T. Sun, Yang, et al, 2021).…”

Methodological Framework to Collect, Process, Analyze and Visualize Cyber Threat Intelligence Data

“…In the context of intelligent CTI data extraction, Sun et al [4] proposes an automatic approach to generate CTI data from open-source threat intelligence publishing platforms (i.e., any platform that shares IOCs or any other useful information about threats) using machine learning and natural language processing together with known threat intelligence background in order to achieve accurate and detailed CTI data that can, for example, feed a tool such as ours in order to help cyber security analysts on threat mitigation. In Preuveneers and Joosen [6], a similar problem was considered by authors when they proposed a solution to complement the sharing of IOCs using machine learning-based threat detection, and they demonstrated their proposed solution by implementing it on state-of-practice open-source CTI sharing and incident response platforms.…”

“…It is known that CTI must explore the collection while filtering, sharing and analyzing vulnerabilities in intel and threat data regardless of vendor, technology or source. For that, much research has been developed to address the collection and filtering of threat intelligence [4,5], as well as sharing and using that data to mitigate threats [6,7].…”