Using entropy and mutual information to extract threat actions from cyber threat intelligence

Ghaith Husari; Xi Niu; Bill Chu; Ehab Al-Shaer

doi:10.1109/ISI.2018.8587343

Using entropy and mutual information to extract threat actions from cyber threat intelligence

Ghaith Husari
, Xi Niu
, Bill Chu
, Ehab Al-Shaer

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

68 Scopus citations

Abstract

With the rapid growth of the cyber attacks, cyber threat intelligence (CTI) sharing becomes essential for providing advance threat notice and enabling timely response to cyber attacks. Our goal in this paper is to develop an approach to extract low-level cyber threat actions from publicly available CTI sources in an automated manner to enable timely defense decision making. Specifically, we innovatively and successfully used the metrics of entropy and mutual information from Information Theory to analyze the text in the cybersecurity domain. Combined with some basic NLP techniques, our framework, called ActionMiner has achieved higher precision and recall than the state-of-the-art Stanford typed dependency parser, which usually works well in general English but not cybersecurity texts.

Original language	English
Title of host publication	2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018
Editors	Dongwon Lee, Ghita Mezzour, Ponnurangam Kumaraguru, Nitesh Saxena
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	1-6
Number of pages	6
ISBN (Electronic)	9781538678480
DOIs	https://doi.org/10.1109/ISI.2018.8587343
State	Published - 24 Dec 2018
Externally published	Yes

Publication series

Name	2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018

Bibliographical note

Publisher Copyright:
© 2018 IEEE.

Keywords

Cyber threat intelligence
Cybersecurity
Information Theory
Malware behavior analysis
NLP
Text mining

ASJC Scopus subject areas

Computer Networks and Communications
Information Systems and Management
Safety, Risk, Reliability and Quality
Communication

Access to Document

10.1109/ISI.2018.8587343

Cite this

Husari, G., Niu, X., Chu, B., & Al-Shaer, E. (2018). Using entropy and mutual information to extract threat actions from cyber threat intelligence. In D. Lee, G. Mezzour, P. Kumaraguru, & N. Saxena (Eds.), 2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018 (pp. 1-6). Article 8587343 (2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/ISI.2018.8587343

Husari, Ghaith ; Niu, Xi ; Chu, Bill et al. / Using entropy and mutual information to extract threat actions from cyber threat intelligence. 2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018. editor / Dongwon Lee ; Ghita Mezzour ; Ponnurangam Kumaraguru ; Nitesh Saxena. Institute of Electrical and Electronics Engineers Inc., 2018. pp. 1-6 (2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018).

@inproceedings{3be81619399d43c1b2d905645f3b8f12,

title = "Using entropy and mutual information to extract threat actions from cyber threat intelligence",

abstract = "With the rapid growth of the cyber attacks, cyber threat intelligence (CTI) sharing becomes essential for providing advance threat notice and enabling timely response to cyber attacks. Our goal in this paper is to develop an approach to extract low-level cyber threat actions from publicly available CTI sources in an automated manner to enable timely defense decision making. Specifically, we innovatively and successfully used the metrics of entropy and mutual information from Information Theory to analyze the text in the cybersecurity domain. Combined with some basic NLP techniques, our framework, called ActionMiner has achieved higher precision and recall than the state-of-the-art Stanford typed dependency parser, which usually works well in general English but not cybersecurity texts.",

keywords = "Cyber threat intelligence, Cybersecurity, Information Theory, Malware behavior analysis, NLP, Text mining",

author = "Ghaith Husari and Xi Niu and Bill Chu and Ehab Al-Shaer",

note = "Publisher Copyright: {\textcopyright} 2018 IEEE.",

year = "2018",

month = dec,

day = "24",

doi = "10.1109/ISI.2018.8587343",

language = "English",

series = "2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "1--6",

editor = "Dongwon Lee and Ghita Mezzour and Ponnurangam Kumaraguru and Nitesh Saxena",

booktitle = "2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018",

address = "United States",

}

Husari, G, Niu, X, Chu, B & Al-Shaer, E 2018, Using entropy and mutual information to extract threat actions from cyber threat intelligence. in D Lee, G Mezzour, P Kumaraguru & N Saxena (eds), 2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018., 8587343, 2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018, Institute of Electrical and Electronics Engineers Inc., pp. 1-6. https://doi.org/10.1109/ISI.2018.8587343

Using entropy and mutual information to extract threat actions from cyber threat intelligence. / Husari, Ghaith; Niu, Xi; Chu, Bill et al.
2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018. ed. / Dongwon Lee; Ghita Mezzour; Ponnurangam Kumaraguru; Nitesh Saxena. Institute of Electrical and Electronics Engineers Inc., 2018. p. 1-6 8587343 (2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Using entropy and mutual information to extract threat actions from cyber threat intelligence

AU - Husari, Ghaith

AU - Niu, Xi

AU - Chu, Bill

AU - Al-Shaer, Ehab

PY - 2018/12/24

Y1 - 2018/12/24

N2 - With the rapid growth of the cyber attacks, cyber threat intelligence (CTI) sharing becomes essential for providing advance threat notice and enabling timely response to cyber attacks. Our goal in this paper is to develop an approach to extract low-level cyber threat actions from publicly available CTI sources in an automated manner to enable timely defense decision making. Specifically, we innovatively and successfully used the metrics of entropy and mutual information from Information Theory to analyze the text in the cybersecurity domain. Combined with some basic NLP techniques, our framework, called ActionMiner has achieved higher precision and recall than the state-of-the-art Stanford typed dependency parser, which usually works well in general English but not cybersecurity texts.

AB - With the rapid growth of the cyber attacks, cyber threat intelligence (CTI) sharing becomes essential for providing advance threat notice and enabling timely response to cyber attacks. Our goal in this paper is to develop an approach to extract low-level cyber threat actions from publicly available CTI sources in an automated manner to enable timely defense decision making. Specifically, we innovatively and successfully used the metrics of entropy and mutual information from Information Theory to analyze the text in the cybersecurity domain. Combined with some basic NLP techniques, our framework, called ActionMiner has achieved higher precision and recall than the state-of-the-art Stanford typed dependency parser, which usually works well in general English but not cybersecurity texts.

KW - Cyber threat intelligence

KW - Cybersecurity

KW - Information Theory

KW - Malware behavior analysis

KW - NLP

KW - Text mining

UR - https://www.scopus.com/pages/publications/85061024848

U2 - 10.1109/ISI.2018.8587343

DO - 10.1109/ISI.2018.8587343

M3 - Conference contribution

AN - SCOPUS:85061024848

T3 - 2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018

SP - 1

EP - 6

BT - 2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018

A2 - Lee, Dongwon

A2 - Mezzour, Ghita

A2 - Kumaraguru, Ponnurangam

A2 - Saxena, Nitesh

PB - Institute of Electrical and Electronics Engineers Inc.

ER -

Husari G, Niu X, Chu B, Al-Shaer E. Using entropy and mutual information to extract threat actions from cyber threat intelligence. In Lee D, Mezzour G, Kumaraguru P, Saxena N, editors, 2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018. Institute of Electrical and Electronics Engineers Inc. 2018. p. 1-6. 8587343. (2018 IEEE International Conference on Intelligence and Security Informatics, ISI 2018). doi: 10.1109/ISI.2018.8587343

Using entropy and mutual information to extract threat actions from cyber threat intelligence

Abstract

Publication series

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Fingerprint

Cite this