Threat Analysis of IoT Security Knowledge Graph Based on Confidence

Zhang, Shuqin; Zhang, Minzhi; Hong, Li; Bai, Guangyao

doi:10.1007/978-3-030-92836-0_22

Cited by 2 publications

(1 citation statement)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Graphs are a natural way to express these types of higher order connections and are used in a variety of cybersecurity contexts [9,10]. These types of networks, when they are intended for providing semantic meaning between heterogeneous data types are also referred to as knowledge graphs [11][12][13]. In order to create a graph representation of a large amount of open source intelligence, we utilize Neo4j which provides a visual interface to search the graph, allows a number of users to interact with the data, and also provides an efficient query time for the database to interact with other analysis systems or to simply query and display the raw OSint text documents that are connected to a relevant exploit or IoC.…”

Section: Introductionmentioning

confidence: 99%

Cybersecurity Threat Hunting and Vulnerability Analysis Using a Neo4j Graph Database of Open Source Intelligence

Pelofske¹,

Liebrock²,

Urias³

2023

Preprint

View full text Add to dashboard Cite

Open source intelligence is a powerful tool for cybersecurity analysts to gather information both for analysis of discovered vulnerabilities and for detecting novel cybersecurity threats and exploits. However the scale of information that is relevant for information security on the internet is always increasing, and is intractable for analysts to parse comprehensively. Therefore methods of condensing the available open source intelligence, and automatically developing connections between disparate sources of information, is incredibly valuable. In this research, we present a system which constructs a Neo4j graph database formed by shared connections between open source intelligence text including blogs, cybersecurity bulletins, news sites, antivirus scans, social media posts (e.g., Reddit and Twitter), and threat reports. These connections are comprised of possible indicators of compromise (e.g., IP addresses, domains, hashes, email addresses, phone numbers), information on known exploits and techniques (e.g., CVEs and MITRE ATT&CK Technique ID's), and potential sources of information on cybersecurity exploits such as twitter usernames. The construction of the database of potential IoCs is detailed, including the addition of machine learning and metadata which can be used for filtering of the data for a specific domain (for example a specific natural language) when needed. Examples of utilizing the graph database for querying connections between known malicious IoCs and open source intelligence documents, including threat reports, are shown. We show that this type of relationship querying can allow for more effective use of open source intelligence for threat hunting, malware family clustering, and vulnerability analysis.

show abstract