CAREER: An Artificial Intelligence (AI)-enabled Analytics Perspective for Developing Proactive Cyber Threat Intelligence

网络攻击继续给现代社会造成可怕的损失。越来越多的公司寻求整合网络威胁情报（CTI），以了解新兴威胁及其与资产漏洞的相关性。然而，目前大部分CTI分析师的做法都是被动的，即在攻击发生后手动检查漏洞（绕过漏洞并允许攻击者操纵网络资产的软件）。更积极主动地使用CTI可能会防止许多网络攻击；特别是，暗网黑客论坛等来源经常包含有关可能出现的利用趋势和攻击媒介的信号。然而，这些大型的、国际性的、不断发展的平台通常包含数百万个帖子，这种规模使得传统的CTI分析难以进行、有限、容易出错且耗时。因此，该项目旨在开发基于文本分析和网络科学的支持人工智能（AI）的分析技术，以识别新兴趋势并将漏洞利用与漏洞联系起来。这项研究产生的模型和结果将被整合到网络安全学生和数据科学家的课程中，以帮助快速培养一支训练有素的劳动力队伍，进行主动的人工智能CTI分析。这个CAREER项目旨在发展两项积极的CTI研究。首先是一种新的历时图转换器（Diachronic Graph Transformer， DGT），通过平衡词嵌入稳定性和捕获它们随时间的变化的先进方法来检测和预测新出现的利用术语、语义和趋势。第二种是一种自监督神经信息检索方法，称为“利用-漏洞自监督链接器”，它以与CTI分析师程序一致的方式将黑客利用与漏洞联系起来，并解释了技术的配置、依赖关系和其他特征。该研究的数据和方法将整合到三个重点中，以改善网络人工智能教育：(1)印第安纳大学人工智能网络安全课程的新课程，(2)加强NSF网络军团奖学金服务机构网络安全课程的资源，以及(3)开放数据科学会议（世界上最大的数据科学社区之一）提供的AI+平台的主动CTI学习模块。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Cyber-attacks continue to exact a terrible toll on modern society. Increasingly, many firms seek to integrate cyber threat intelligence (CTI) about emerging threats and their relevance to vulnerabilities within their assets. However, much of the current CTI analyst practice is reactive, in which analysis manually examines exploits (software that circumvents vulnerabilities and allows an attacker to manipulate cyber-assets) after an attack. More proactive approaches to using CTI might prevent many cyber-attacks; in particular, sources such as Dark Web hacker forums often include signals about possible emerging exploit trends and attack vectors. However, these large, international, and ever-evolving platforms often contain millions of posts, a scale that makes conventional CTI analysis prohibitive, limited, error-prone, and time-consuming. Therefore, this project seeks to develop Artificial Intelligence (AI)-enabled analytics techniques based on text analysis and network science to identify emerging trends and to link exploits to vulnerabilities. The models and results produced from this research will be integrated into curricula for cybersecurity students and data scientists to help rapidly grow a well-trained workforce in proactive AI-enabled CTI analytics. This CAREER project seeks to develop two thrusts of proactive CTI research. The first is a novel Diachronic Graph Transformer (DGT) to detect and predict emerging exploit terms, semantics, and trends through advancing methods for balancing word embedding stability and capturing their shifts over time. The second is a self-supervised neural information retrieval method, entitled the Exploit-Vulnerability Self-Supervised Linker, that links hacker exploits to vulnerabilities in a manner consistent with CTI analysts' procedures and that accounts for a technology's configurations, dependencies, and other characteristics. The data and methods from this research will be integrated into three thrusts to improve cyber-AI education: (1) new lessons for an AI for Cybersecurity course at Indiana University, (2) resources to enhance the cybersecurity curricula of NSF CyberCorps Scholarship-for-Service institutions, and (3) proactive CTI learning modules for the AI+ platform offered by the Open Data Science Conference, one of the world's largest data science communities.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.