Extractor: Extracting Attack Behavior from Threat Reports

Satvat, Kiavash; Gjomemo, Rigel; Venkatakrishnan, V.

doi:10.1109/eurosp51992.2021.00046

Cited by 47 publications

(19 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Research progress has been made to automatically extract knowledge about attacks from CTI reports. Subfigures (B) to (D) show the information retrieved from the report sample by EXTRACTOR [43] TTPDrill [30], and ChainSmith [49], respectively, while Subfigure (A) represents the manually generated ground-truth. Subfigure (D) presents the attack graph generated by EXTRACTOR with IoCs and dependencies.…”

Section: Motivating Examplementioning

confidence: 99%

“…Detailed labeling results are available in Appendix A. Given ground-truth entities and dependencies in the reports, we are able to compare AttacKG with the state-of-the-art open-source 4 CTI report parser, EXTRACTOR [43], in terms of the precision, recall, and F1-score. For a fair comparison, we enable all optimizations in EXTRACTOR (e.g., Ellipsis Subject Resolution) when constructing attack graphs upon textual attack descriptions.…”

Section: Rq1: How Accurate Is Attackg In Extracting Attack Graphs Fro...mentioning

confidence: 99%

“…Further, we identify techniques in the attack graph based on general "Technique Templates" that aggregates technique knowledge from MITRE ATT&CK [11] in a graph structure. While prior studies [24,36,43] have attempted to automatically retrieve information from CTI reports, existing CTI parsing systems are not general enough. More specifically, existing parsers primarily focus on IoC-related behaviors while extracting attack behavior graphs.…”

Section: Introductionmentioning

confidence: 99%

“…We implement AttacKG and evaluate it against 7,373 examples of 179 techniques crawled from MITRE ATT&CK and 1,515 CTI reports collected from multiple intelligence sources, such as Cisco Talos Intelligence Group [1], Microsoft Security Intelligence Center [14], and DARPA Transparent Computing (TC) program [4]. Our experimental result demonstrates that AttacKG substantially outperforms existing CTI parsing solutions such as EXTRACTOR [43] and TTPDrill [30]: (1) with the CTI report parsing pipeline, AttacKG accurately constructs attack graphs from reports with F1-scores of 0.895 and 0.911 for entities and dependencies extraction, respectively;…”

Section: Introductionmentioning

confidence: 99%

“…Further, to verify AttacKG's accuracy in extracting threat intelligence, we run AttacKG on eight manually labeled CTI reports. Empirical results show that AttacKG accurately identifies attack-relevant entities, dependencies, and techniques with F1-scores of 0.895, 0.911, and 0.819, which significantly outperforms the state-of-the-art approaches like EXTRACTOR [43] and TTPDrill [30].…”

mentioning

confidence: 99%

See 4 more Smart Citations

AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports

Li¹,

Zeng²,

Chen³

et al. 2021

Preprint

View full text Add to dashboard Cite

Cyber attacks are becoming more sophisticated and diverse, making detection increasingly challenging. To combat these attacks, security practitioners actively summarize and exchange their knowledge about attacks across organizations in the form of cyber threat intelligence (CTI) reports. However, as CTI reports written in natural language texts are not structured for automatic analysis, the report usage requires tedious efforts of manual cyber intelligence recovery. Additionally, individual reports typically cover only a limited aspect of attack patterns (techniques) and thus are insufficient to provide a comprehensive view of attacks with multiple variants.To take advantage of threat intelligence delivered by CTI reports, we propose AttacKG to automatically extract structured attack behavior graphs from CTI reports and identify the adopted attack techniques. We then aggregate cyber intelligence across reports to collect different aspects of techniques and enhance attack behavior graphs as technique knowledge graphs (TKGs). Such TKGs with technique-level intelligence directly benefit downstream security tasks that rely on technique specifications, e.g., Advanced Persistent Threat (APT) detection.In our evaluation against 1,515 real-world CTI reports from diverse intelligence sources, AttacKG effectively identifies 28,262 attack techniques with 8,393 unique Indicators of Compromises (IoCs). Further, to verify AttacKG's accuracy in extracting threat intelligence, we run AttacKG on eight manually labeled CTI reports. Empirical results show that AttacKG accurately identifies attack-relevant entities, dependencies, and techniques with F1-scores of 0.895, 0.911, and 0.819, which significantly outperforms the state-of-the-art approaches like EXTRACTOR [43] and TTPDrill [30].

show abstract

Section: Motivating Examplementioning

confidence: 99%

Section: Rq1: How Accurate Is Attackg In Extracting Attack Graphs Fro...mentioning

confidence: 99%