CRII: SaTC: Identifying Emerging Threats in the Online Hacker Community for Proactive Cyber Threat Intelligence: A Diachronic Graph Convolutional Autoencoder Framework

黑客经常针对从金融到医疗保健等领域的关键系统的基础信息系统。目前，防御和应对黑客攻击事件的估计成本每年高达数千亿美元。 为了降低这些成本，许多组织都致力于开发有关安全和隐私威胁的及时、相关、可操作和可共享的网络威胁情报（CTI），以支持网络安全决策。 然而，现有的方法往往对已知的威胁做出反应，而不是主动检测新出现的威胁。 一种很有前途的主动攻击检测方法是挖掘大型、国际化和快速发展的在线黑客社区平台，以检测新出现的威胁和关键参与者。 为此，该项目旨在通过以下方式开发先进的主动CTI功能：（1）收集黑客论坛帖子的大型动态数据集;（2）开发分析方法，通过基于图形的新颖方法对文本内容进行建模，以提取新出现的威胁，特别是恶意软件。 为了实现这些目标，该项目旨在开发一个新的CTI框架，旨在收集和识别来自数百万记录黑客论坛的新威胁。 为了解决收集大规模和动态数据集的问题，该团队将开发先进的混淆爬行机制，绕过自动收集对策，同时需要最少的人工参与。 收集的数据将被分割成时间段，并通过一种新的计算算法，历时图卷积自动编码器（D-GCAE）进行分析。D-GCAE植根于历时语言学、网络科学、文本挖掘和深度学习社区的方法。 在这个项目中，D-GCAE将在每个时间段提取图形嵌入，对齐嵌入，并分析黑客术语的语义变化，以识别潜在的新兴威胁。 这些工具将根据计算机科学和相关领域提出的最先进的基准进行评估，并通过分析领先的计算机技术倡议共享组织的产出进行评估。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Hackers often target the information systems that underlie critical systems in domains ranging from finance to healthcare. The estimated cost of defending against and responding to hacking incidents currently runs at hundreds of billions of dollars annually. To reduce these costs, many organizations have aimed to develop timely, relevant, actionable, and shareable Cyber Threat Intelligence (CTI) about security and privacy threats to support cybersecurity decision-making. However, existing methods tend to react to known threats rather than proactively detecting emerging ones. One promising approach to proactive exploit detection is mining large, international, and rapidly evolving online hacker community platforms to detect emerging threats and key actors. To this end, this project aims to develop advanced, proactive CTI capabilities through (1) collecting large, dynamic datasets of hacker forum posts and (2) developing methods to analyze them to extract emerging threats, particularly malware, through a novel graph-based method for modeling text content. To achieve these goals, this project aims to develop a novel CTI framework designed to collect and identify emerging threats from multi-million record hacker forums. To address the problem of collecting large-scale and dynamic datasets, the team will develop advanced obfuscated crawling mechanisms that bypass automated collection countermeasures while requiring minimal human involvement. The data collected will be segmented into time spells and analyzed by a novel computational algorithm, the Diachronic Graph Convolutional Autoencoder (D-GCAE). D-GCAE is rooted in methods drawn from the diachronic linguistics, network science, text mining, and deep learning communities. In this project, D-GCAE will extract graph embeddings at each time spell, align embeddings, and analyze semantic shifts of hacker terminology to identify potential emerging threats. These tools will be evaluated against both state-of-the-art benchmarks proposed in computer science and related domains and through analysis of their outputs by leading CTI sharing organizations. The datasets and tools will also be disseminated for use by cybersecurity researchers, practitioners, and educators.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.