Cyber Threat Intelligence for SOC Analysts

Abstract

knowledge-driven threat intelligence models that incorporate domain knowledge and relevant contextual information. This work will also result in faster attack detection and mitigation and better allocation of defensive resources. Toward these goals, this project is exploring the following two research directions:1) Enable the inclusion of domain security knowledge catering to different context vs. data relevance needs. A key challenge is to combine external abstract threat knowledge with internal, domain-specific knowledge. 2) Enable robust adaptation of time and trust varying, dynamically changing cyber threat knowledge in domainspecific information sources. A key challenge is to extract meaningful information with confidence. 3) Overcome the lack of evaluation mechanisms for context. A key challenge is combining ML's precision and accuracy to the ranked inferences of knowledge graphs applicable to given organizational policies and trustworthiness. This paper discusses ongoing research capturing the first goal and leaves the other two for future work.