Abstract:
Automated analytics of cyber threat knowledge is crucial for network threat
isolation and risk mitigation. Consequently, there has been growing interest
in implementing a proactive line of defense through threats pro ling. How-
ever, determining the resiliency of particular network con gurations with
respect to relevant threats reported in cyber threat intelligence (CTI) shared
data remains a challenge, largely due to lack of semantics and contextual
information present in textual representation of the threat knowledge. To
overcome the limitations of existing CTI frameworks, we devise a threat ana-
lytics framework known as STIX-Analyzer based on OntologyWeb Language
(OWL) for formal speci cation, semantic reasoning and contextual analy-
sis that allows the derivation of network associated threats from volumes of
shared threat feeds. Our ontology represents constructs of Structured Threat
Information eXpression (STIX) with the additional concepts of Cyber Ob-
servable eXpression (Cybox), network con gurations, and Common Vulner-
abilities and Exposures (CVEs) for risk analysis and threat actors pro ling.
STIX-Analyzer provides an automated mechanism for realizing cyber threats
targeting the network under question by classifying the threat relevance, de-
termining threat likelihood, total loss of a ected assets, threat reachability
and attributing threats to their sources through formulated rules and infer-
ence. Threat attribution analyzes threat frequency, tra c and actors pro le.
Comprehensive structural and conceptual evaluation is performed on criti-
cal APTs/espionages from credible source on collection of arbitrary network
to examine OWL clarity, consistency, capability, expandability, reusability,
scalability in terms of reasoning time, memory reservation and processor uti-
lization with the quality of reasoning achieved during threat relevance identi-
cation and threat actors attribution with the attributes present in network
imported instances.
