Cybersecurity Threat Intelligence Augmentation and Embedding Improvement - A Healthcare Usecase
Cybersecurity Threat Intelligence Augmentation and Embedding Improvement - A Healthcare Usecase
复制标题
DOI：
10.1109/isi49825.2020.9280482
复制
发表时间：
2020-11
期刊：
影响因子：
--
通讯作者：
Matthew Sills;P. Ranade;Sudip Mittal
中科院分区：
文献类型：
--
作者：
Matthew Sills;P. Ranade;Sudip Mittal
随着物联网(IoT)设备在医疗环境中的实施，引入了越来越多的安全漏洞和威胁。缺乏可扩展的大数据资源来捕获医疗设备漏洞，限制了基于人工智能(AI)的网络防御系统在捕获、检测和防止已知和未来攻击方面的使用。我们描述了一个系统，它生成关于各种医疗设备及其已知漏洞的网络威胁情报(CTI)存储库，这些漏洞来自制造商和ICS-CERT漏洞警报。我们使用维基数据和公共医疗数据库等数据源来增强情报存储库。组合的资源与我们之前研究的网络安全知识图(CKG)中的威胁情报相集成。增强图嵌入在查询相关信息时很有用，并可以帮助执行各种人工智能辅助的网络安全任务。考虑到多个资源的整合，我们发现扩展的CKG产生了更高质量的图形表示。增强的CKG使平均平均精度(MAP)值增加了31%，这是通过信息检索任务计算得出的。
The implementation of Internet of Things (IoT) devices in medical environments, has introduced a growing list of security vulnerabilities and threats. The lack of an extensible big data resource that captures medical device vulnerabilities limits the use of Artificial Intelligence (AI) based cyber defense systems in capturing, detecting, and preventing known and future attacks. We describe a system that generates a repository of Cyber Threat Intelligence (CTI) about various medical devices and their known vulnerabilities from sources such as manufacturer and ICS-CERT vulnerability alerts. We augment the intelligence repository with data sources such as Wikidata and public medical databases. The combined resources are integrated with threat intelligence in our Cybersecurity Knowledge Graph (CKG) from previous research. The augmented graph embeddings are useful in querying relevant information and can help in various AI assisted cybersecurity tasks. Given the integration of multiple resources, we found the augmented CKG produced higher quality graph representations. The augmented CKG produced a 31% increase in the Mean Average Precision (MAP) value, computed over an information retrieval task.