Extractor: Extracting Attack Behavior from Threat Reports
Extractor: Extracting Attack Behavior from Threat Reports
复制标题
DOI：
10.1109/eurosp51992.2021.00046
复制
发表时间：
2021-04
期刊：
影响因子：
--
通讯作者：
Kiavash Satvat;Rigel Gjomemo;V. Venkatakrishnan
中科院分区：
文献类型：
--
作者：
Kiavash Satvat;Rigel Gjomemo;V. Venkatakrishnan
网络威胁情报（CTI）报告中包含的攻击知识对于有效识别和快速响应网络威胁非常重要。然而，这些知识往往嵌入在大量的文本中，因此很难有效地使用。为了解决这一挑战，我们提出了一种新的方法和工具，称为提取器，允许精确的自动提取简洁的攻击行为从CTI报告。Extractor对文本没有强有力的假设，能够从非结构化文本中提取攻击行为作为起源图。我们使用来自各种来源的真实事件报告以及DARPA对抗活动的报告来评估Extractor，这些报告涉及Windows，Linux和FreeBSD等各种操作系统平台上的几次攻击活动。我们的评估结果表明，提取器可以从CTI报告中提取简洁的出处图，并表明这些图可以成功地被网络分析工具用于威胁搜索。
The knowledge on attacks contained in Cyber Threat Intelligence (CTI) reports is very important to effectively identify and quickly respond to cyber threats. However, this knowledge is often embedded in large amounts of text, and therefore difficult to use effectively. To address this challenge, we propose a novel approach and tool called Extractor that allows precise automatic extraction of concise attack behaviors from CTI reports. Extractor makes no strong assumptions about the text and is capable of extracting attack behaviors as provenance graphs from unstructured text. We evaluate Extractor using real-world incident reports from various sources as well as reports of DARPA adversarial engagements that involve several attack campaigns on various OS platforms of Windows, Linux, and FreeBSD. Our evaluation results show that Extractor can extract concise provenance graphs from CTI reports and show that these graphs can successfully be used by cyber-analytics tools in threat-hunting.