Uncovering multi-step attacks with threat knowledge graph reasoningOACSCD

The rapid advancement of information technologies has significantly intensified the focus on cyberspace security across various sectors.In this evolving landscape,attackers deploy many techniques-including exploits,weakness identification,and complex multi-step attacks-to gain unauthorized access to systems.Conversely,defenders harness insights from a variety of sources to pinpoint potential threats.Prominent public cybersecurity databases such as the Adversarial Tactics,Techniques,and Common Knowledge(ATT&CK),Common Attack Pattern Enumeration and Classification(CAPEC),Common Vulnerabilities and Exposures(CVE),Common Weakness Enumeration(CWE),and Common Platform Enumeration(CPE)provide extensive data on security entities and their interrelations,playing a pivotal role in enriching the understanding of cybersecurity challenges and assisting in comprehensive defensive analyses.However,the semantic cross-analysis of these databases,crucial for identifying obscure threat patterns,remains underexploited.In this study,we amalgamate data from these disparate sources into a cohesive threat knowledge graph and introduce a novel knowledge representation learning approach,A4CKGE(ATT&CKCAPEC-CWE-CVE-CPE Knowledge Graph Embedding).This method utilizes advanced structural and textual analytics to predict interactions among security entities such as products,vulnerabilities,weaknesses,and multi-step attack sequences,employing complex attack templates generated through a Large Language Model(LLM).Our extensive experiments demonstrate that this approach significantly outperforms existing state-of-the-art methods in effectively predicting these relationships.The findings validate the efficacy of our threat knowledge graph in unveiling hidden connections,thereby highlighting its potential to strengthen cybersecurity defenses substantially.