Learning APT chains from cyber threat intelligence

Ghaith Husari; Ehab Al-Shaer; Bill Chu; Ruhani Faiheem Rahman

doi:10.1145/3314058.3317728

Learning APT chains from cyber threat intelligence

Ghaith Husari
, Ehab Al-Shaer
, Bill Chu
, Ruhani Faiheem Rahman

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

13 Scopus citations

Abstract

With the rapidly evolving cyber attacks, cybersecurity specialists are actively using cyber threat intelligence to identify and respond to cyber attacks in a timely manner. However, this information will be highly useful for attack detection and mitigation if we can construct structured cyber threat intelligence and accurately generate TTP Chains to understand the steps of cyber attacks. In this poster, we present our preliminary Natural Language Processing (NLP) analysis to characterize the temporal relationship of attack actions of an APT attack to extract and construct the reported TTP chains using the popular standard, MITRE ATT&CK [1], and the Structured Sharing Language, STIX 2 [2], a machine-readable language that will help automate the process of understanding and responding to the cyber attacks shared in unstructured text via blogs, emails, and social media.

Original language	English
Title of host publication	Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019
Publisher	Association for Computing Machinery
ISBN (Electronic)	9781450371476
DOIs	https://doi.org/10.1145/3314058.3317728
State	Published - 1 Apr 2019
Externally published	Yes
Event	6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019 - Nashville, United States Duration: 1 Apr 2019 → 3 Apr 2019

Publication series

Name	ACM International Conference Proceeding Series

Conference

Conference	6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019
Country/Territory	United States
City	Nashville
Period	1/04/19 → 3/04/19

Bibliographical note

Publisher Copyright:
© 2019 Copyright held by the owner/author(s).

ASJC Scopus subject areas

Software
Human-Computer Interaction
Computer Vision and Pattern Recognition
Computer Networks and Communications

Access to Document

10.1145/3314058.3317728

Cite this

@inproceedings{c3d3829e6837409982b45cb0cafde588,

title = "Learning APT chains from cyber threat intelligence",

abstract = "With the rapidly evolving cyber attacks, cybersecurity specialists are actively using cyber threat intelligence to identify and respond to cyber attacks in a timely manner. However, this information will be highly useful for attack detection and mitigation if we can construct structured cyber threat intelligence and accurately generate TTP Chains to understand the steps of cyber attacks. In this poster, we present our preliminary Natural Language Processing (NLP) analysis to characterize the temporal relationship of attack actions of an APT attack to extract and construct the reported TTP chains using the popular standard, MITRE ATT\&CK [1], and the Structured Sharing Language, STIX 2 [2], a machine-readable language that will help automate the process of understanding and responding to the cyber attacks shared in unstructured text via blogs, emails, and social media.",

author = "Ghaith Husari and Ehab Al-Shaer and Bill Chu and Rahman, \{Ruhani Faiheem\}",

note = "Publisher Copyright: {\textcopyright} 2019 Copyright held by the owner/author(s).; 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019 ; Conference date: 01-04-2019 Through 03-04-2019",

year = "2019",

month = apr,

day = "1",

doi = "10.1145/3314058.3317728",

language = "English",

series = "ACM International Conference Proceeding Series",

publisher = "Association for Computing Machinery",

booktitle = "Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019",

}

Husari, G, Al-Shaer, E, Chu, B & Rahman, RF 2019, Learning APT chains from cyber threat intelligence. in Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019., a19, ACM International Conference Proceeding Series, Association for Computing Machinery, 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019, Nashville, United States, 1/04/19. https://doi.org/10.1145/3314058.3317728

Learning APT chains from cyber threat intelligence. / Husari, Ghaith; Al-Shaer, Ehab; Chu, Bill et al.
Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019. Association for Computing Machinery, 2019. a19 (ACM International Conference Proceeding Series).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Learning APT chains from cyber threat intelligence

AU - Husari, Ghaith

AU - Al-Shaer, Ehab

AU - Chu, Bill

AU - Rahman, Ruhani Faiheem

PY - 2019/4/1

Y1 - 2019/4/1

N2 - With the rapidly evolving cyber attacks, cybersecurity specialists are actively using cyber threat intelligence to identify and respond to cyber attacks in a timely manner. However, this information will be highly useful for attack detection and mitigation if we can construct structured cyber threat intelligence and accurately generate TTP Chains to understand the steps of cyber attacks. In this poster, we present our preliminary Natural Language Processing (NLP) analysis to characterize the temporal relationship of attack actions of an APT attack to extract and construct the reported TTP chains using the popular standard, MITRE ATT&CK [1], and the Structured Sharing Language, STIX 2 [2], a machine-readable language that will help automate the process of understanding and responding to the cyber attacks shared in unstructured text via blogs, emails, and social media.

AB - With the rapidly evolving cyber attacks, cybersecurity specialists are actively using cyber threat intelligence to identify and respond to cyber attacks in a timely manner. However, this information will be highly useful for attack detection and mitigation if we can construct structured cyber threat intelligence and accurately generate TTP Chains to understand the steps of cyber attacks. In this poster, we present our preliminary Natural Language Processing (NLP) analysis to characterize the temporal relationship of attack actions of an APT attack to extract and construct the reported TTP chains using the popular standard, MITRE ATT&CK [1], and the Structured Sharing Language, STIX 2 [2], a machine-readable language that will help automate the process of understanding and responding to the cyber attacks shared in unstructured text via blogs, emails, and social media.

UR - https://www.scopus.com/pages/publications/85068742488

U2 - 10.1145/3314058.3317728

DO - 10.1145/3314058.3317728

M3 - Conference contribution

AN - SCOPUS:85068742488

T3 - ACM International Conference Proceeding Series

BT - Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019

PB - Association for Computing Machinery

T2 - 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019

Y2 - 1 April 2019 through 3 April 2019

ER -

Learning APT chains from cyber threat intelligence

Abstract

Publication series

Conference

Bibliographical note

ASJC Scopus subject areas

Access to Document

Fingerprint

Cite this