Open-CyKG: An Open Cyber Threat Intelligence Knowledge Graph

Knowledge-Based Systems, vol. 233, pp. 107524

Abstract

Instant analysis of cybersecurity reports is a fundamental challenge for security experts as an immeasurable amount of cyber information is generated on a daily basis, which necessitates automated information extraction tools to facilitate querying and retrieval of data. Hence, we present Open-CyKG: an Open Cyber Threat Intelligence (CTI) Knowledge Graph (KG) framework that is constructed using an attention-based neural Open Information Extraction (OIE) model to extract valuable cyber threat information from unstructured Advanced Persistent Threat (APT) reports. More specifically, we first identify relevant entities by developing a neural cybersecurity Named Entity Recognizer (NER) that aids in labeling relation triples generated by the OIE model. Afterwards, the extracted structured data is canonicalized to build the KG by employing fusion techniques using word embeddings. As a result, security professionals can execute queries to retrieve valuable information from the Open-CyKG framework. Experimental results demonstrate that our proposed components that build up Open-CyKG outperform state-of-the-art models.1

Authors 2

1. Injy Sarhan corresponding

   Utrecht University · Arab Academy for Science, Technology, and Maritime Transport

   Affiliation as printed

   Department of Computer Engineering, Arab Academy for Science, Technology, and Maritime Transport (AAST), Alexandria, Egypt

   Department of Information and Computing Sciences, Utrecht University, Utrecht, The Netherlands

2. Marco René Spruit Aachen Department of Public Health and Primary Care Leiden Institute of Advanced Computer Science

   Leiden University · Utrecht University · Leiden University Medical Center

   Affiliation as printed

   Department of Information and Computing Sciences, Utrecht University, Utrecht, The Netherlands

   Department of Public Health and Primary Care, Leiden University Medical Center(LUMC), Leiden, The Netherlands

   Leiden Institute of Advanced Computer Science (LIACS), Leiden University, Leiden, The Netherlands