Predicting correlation relationships of entities between attack patterns and techniques based on word embedding and graph convolutional network

Weicheng QIU; Xiuzhen CHEN; Yinghua MA; Jin MA; Zhihong ZHOU

doi:10.11959/j.issn.2096-109x.2023052

您当前的位置：

首页 >

文章列表页 >

Predicting correlation relationships of entities between attack patterns and techniques based on word embedding and graph convolutional network

Papers | 更新时间：2024-06-03

- Predicting correlation relationships of entities between attack patterns and techniques based on word embedding and graph convolutional network
- Chinese Journal of Network and Information Security Vol. 9, Issue 4, Pages: 40-52(2023)
- 作者机构：
  
  1. 上海交通大学网络安全技术研究院，上海 200240
  2. 上海市信息安全综合管理技术重点实验室，上海 200240
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2023052
  CLC： TP393
- Online First：2023-08，
  
  Published：25 August 2023
- 稿件说明：
移动端阅览
Weicheng QIU, Xiuzhen CHEN, Yinghua MA, et al. Predicting correlation relationships of entities between attack patterns and techniques based on word embedding and graph convolutional network[J]. Chinese Journal of Network and Information Security, 2023, 9(4): 40-52.
DOI：

Weicheng QIU, Xiuzhen CHEN, Yinghua MA, et al. Predicting correlation relationships of entities between attack patterns and techniques based on word embedding and graph convolutional network[J]. Chinese Journal of Network and Information Security, 2023, 9(4): 40-52. DOI： 10.11959/j.issn.2096-109x.2023052.

摘要

安全威胁分析以包含大量安全实体的网络安全知识库为基础，对威胁源、攻击能力、攻击动机、威胁路径等建模，并结合资产的脆弱性及已部署的安全措施，评估威胁的影响范围、程度以及带来的安全风险。但是基础知识库部分实体之间的关联关系缺失，不利于实现安全事件追踪、攻击路径关联。针对 CAPEC 攻击模式和ATT＆amp;CK技术的实体关系缺失问题，提出一种基于词向量和图卷积的攻击模式与技术实体关联方法，即通过分析实体描述文本之间的关联度判断实体关系，达到不同知识库间实体关系的补充、丰富威胁路径的目的。提出的方法使用预训练的安全领域Word2Vec模型提取特定领域的语义信息，通过图卷积神经网络模型提取实体描述间的共现关系，进一步将两种特征输入孪生网络预测实体间的关联关系。为解决现有知识库中实体关系较少的小样本学习问题，通过词向量补充外部语义信息、模型训练时使用动态负采样和添加正则项避免过拟合。针对MITRE组织提供的CAPEC和ATT＆amp;CK知识库进行实验测试，结果表明，所提算法可以通过分析实体描述的语义信息，将有关系的实体对在样本空间内与无关系实体对分离，从而有效预测新的实体对的关联关系。在小样本条件下，所提方法的预测准确率高于基于Bert 的文本相似度预测方法，同时训练时间更短、所需计算资源更少。实验结果证明，基于词向量和图卷积的攻击模式与技术实体关联方法可以挖掘出新的攻击模式与技术实体关联关系，安全威胁分析时有助于提高从安全漏洞和脆弱点等底层概念抽象出攻击技术和战术的能力。

Abstract

Threat analysis relies on knowledge bases that contain a large number of security entities.The scope and impact of security threats and risks are evaluated by modeling threat sources

attack capabilities

attack motivations

and threat paths

taking into consideration the vulnerability of assets in the system and the security measures implemented.However

the lack of entity relations between these knowledge bases hinders the security event tracking and attack path generation.To complement entity relations between CAPEC and ATT＆amp;CK techniques and enrich threat paths

an entity correlation prediction method called WGS was proposed

in which entity descriptions were analyzed based on word embedding and a graph convolution network.A Word2Vec model was trained in the proposed method for security domain to extract domain-specific semantic features and a GCN model to capture the co-occurrence between words and sentences in entity descriptions.The relationship between entities was predicted by a Siamese network that combines these two features.The inclusion of external semantic information helped address the few-shot learning problem caused by limited entity relations in the existing knowledge base.Additionally

dynamic negative sampling and regularization was applied in model training.Experiments conducted on CAPEC and ATT＆amp;CK database provided by MITRE demonstrate that WGS effectively separates related entity pairs from irrelevant ones in the sample space and accurately predicts new entity relations.The proposed method achieves higher prediction accuracy in few-shot learning and requires shorter training time and less computing resources compared to the Bert-based text similarity prediction models.It proves that word embedding and graph convolutional network based entity relation prediction method can extract new entity correlation relationships between attack patterns and techniques.This helps to abstract attack techniques and tactics from low-level vulnerabilities and weaknesses in security threat analysis.

关键词

Keywords

references

STROM B E , APPLEBAUM A , MILLER D P , et al . Mitre att＆ck:design and philosophy [R ] . Technical Report , 2018 .

KIESLING E , EKELHART A , KURNIAWAN K , et al . The SEPSES knowledge graph:an integrated resource for cybersecurity [C ] // International Semantic Web Conference . 2019 : 198 - 214 .

GUO Y , LIU Z , HUANG C , et al . CyberRel:joint entity and relation extraction for cybersecurity concepts [C ] // International Conference on Information and Communications Security . 2021 : 447 - 463 .

XIAO H , XING Z , LI X , et al . Embedding and predicting software security entity relationships:a knowledge graph based approach [C ] // International Conference on Neural Information Processing . 2019 : 50 - 63 .

YUAN L , BAI Y , XING Z , et al . Predicting entity relations across different security databases by using graph attention network [C ] // 2021 IEEE 45th Annual Computers,Software,and Applications Conference (COMPSAC) . 2021 : 834 - 843 .

DAS S S , SERRA E , HALAPPANAVAR M , et al . V2W-BERT:a framework for effective hierarchical multiclass classification of software vulnerabilities [C ] // 2021 IEEE 8th International Conference on Data Science and Advanced Analytics (DSAA) . 2021 : 1 - 12 .

MILAJERDI S M , GJOMEMO R , ESHETE B , et al . Holmes:real-time apt detection through correlation of suspicious information flows [C ] // 2019 IEEE Symposium on Security and Privacy (SP) . 2019 : 1137 - 1152 .

WU L , CHEN Y , SHEN K , et al . Graph neural networks for natural language processing:a survey [J ] . arXiv Preprint arXiv:2106.06090 , 2021 .

YAO L , MAO C , LUO Y . Graph convolutional networks for text classification [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . 2019 : 7370 - 7377 .

LIU B , NIU D , WEI H , et al . Matching article pairs with graphical decomposition and convolutions [J ] . arXiv Preprint arXiv:1802.07459 , 2018 .

REIMERS N , GUREVYCH I . Sentence-bert:sentence embeddings using siamese bert-networks [J ] . arXiv Preprint arXiv:1908.10084 , 2019 .

DEVLIN J , CHANG M W , LEE K , et al . Bert:pre-training of deep bidirectional transformers for language understanding [J ] . arXiv Preprint arXiv:1810.04805 , 2018 .

VASWANI A , SHAZEER N , PARMAR N , et al . Attention is all you need [C ] // Advances in Neural Information Processing Systems , 2017 ,30.

LIU Y , OTT M , GOYAL N , et al . Roberta:a robustly optimized bert pretraining approach [J ] . arXiv Preprint arXiv:1907.11692 , 2019 .

LAN Z , CHEN M , GOODMAN S , et al . Albert:a lite bert for self-supervised learning of language representations [J ] . arXiv Preprint arXiv:1909.11942 , 2019 .

YANG Z , DAI Z , YANG Y , et al . Xlnet:generalized autoregressive pretraining for language understanding [C ] // Advances in Neural Information Processing Systems , 2019 ,32.

LIU B , NIU D , WEI H , et al . Matching article pairs with graphical decomposition and convolutions [J ] . arXiv Preprint arXiv:1802.07459 , 2018 .

MIKOLOV T , CHEN K , CORRADO G , et al . Efficient estimation of word representations in vector space [J ] . arXiv Preprint arXiv:1301.3781 , 2013 .

KIPF T N , WELLING M . Semi-supervised classification with graph convolutional networks [J ] . arXiv Preprint arXiv:1609.02907 , 2016 .

LE Q , MIKOLOV T . Distributed representations of sentences and documents [C ] // International Conference on Machine Learning . PMLR , 2014 : 1188 - 1196 .

CER D , DIAB M , AGIRRE E , et al . Semeval-2017 task 1:semantic textual similarity-multilingual and cross-lingual focused evaluation [J ] . arXiv Preprint arXiv:1708.00055 , 2017 .

Views

417

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on multi-granularity password analysis based on LLM

NLP neural network copyright protection based on black box watermark

Related Author

Meng HONG

Weidong QIU

Yangde WANG

Long DAI

Jing ZHANG

Xuefeng FAN

Xiaoyi ZHOU

Related Institution

No data

⁰