Study of Natural Language Processing for Collecting Cyber Threat Intelligence Using SyntaxNet
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Kim, N. | - |
dc.contributor.author | Kim, M. | - |
dc.contributor.author | Lee, S. | - |
dc.contributor.author | Cho, H. | - |
dc.contributor.author | Kim, B.-I. | - |
dc.contributor.author | Park, J.-H. | - |
dc.contributor.author | Jun, M.S. | - |
dc.date.available | 2019-06-11T06:40:05Z | - |
dc.date.created | 2019-06-11 | - |
dc.date.issued | 2019-05 | - |
dc.identifier.issn | 1876-1100 | - |
dc.identifier.uri | http://scholarworks.bwise.kr/ssu/handle/2018.sw.ssu/34799 | - |
dc.description.abstract | The importance of cyberattack analysis has increased for responding quickly and effectively to cyber threats, which are becoming more intelligent. Analyzing cyberattacks requires examining the resources (malicious code, IP, domain, vulnerability, etc.) used in the cyberattack, similarity between the resources, attack technique, attack target, and activity time. It is also necessary to collect the data to be used in the analysis of a cyberattack. The formatted data shared through a specific format can be collected according to that format. However, it is difficult to collect the data when the cyberattack analyst generates the analysis result in unformatted data in the form of a report. As a way to solve this problem, this paper proposes the technique of using natural language processing technology to collect the Indicator of Compromise (IoC) in the form of a report. We have outlined the technologies and designed the processing procedure needed to extract resource data (IoC) abused in cyberattacks and the attack techniques (TTPs) included in the report based on the natural language processing model (SyntaxNet) disclosed as open source by Google. Extracting 345,364 token data based on 190 malware(and cyberattack) analysis reports and testing of them by dividing them into learning and test data in the ratio of about 9:1 resulted in extraction of IoC data at an average f1-score of 76%. © 2019, Springer Nature Switzerland AG. | - |
dc.language | 영어 | - |
dc.language.iso | en | - |
dc.publisher | Springer Verlag | - |
dc.relation.isPartOf | Lecture Notes in Electrical Engineering | - |
dc.title | Study of Natural Language Processing for Collecting Cyber Threat Intelligence Using SyntaxNet | - |
dc.type | Article | - |
dc.identifier.doi | 10.1007/978-3-030-20717-5_2 | - |
dc.type.rims | ART | - |
dc.identifier.bibliographicCitation | Lecture Notes in Electrical Engineering, v.565, pp.10 - 18 | - |
dc.description.journalClass | 1 | - |
dc.identifier.scopusid | 2-s2.0-85066126160 | - |
dc.citation.endPage | 18 | - |
dc.citation.startPage | 10 | - |
dc.citation.title | Lecture Notes in Electrical Engineering | - |
dc.citation.volume | 565 | - |
dc.contributor.affiliatedAuthor | Jun, M.S. | - |
dc.type.docType | Conference Paper | - |
dc.description.isOpenAccess | N | - |
dc.subject.keywordAuthor | Cyber threat intelligence | - |
dc.subject.keywordAuthor | Cyberattack natural language processing | - |
dc.subject.keywordAuthor | SyntaxNet | - |
dc.subject.keywordPlus | Data acquisition | - |
dc.subject.keywordPlus | Data mining | - |
dc.subject.keywordPlus | Natural language processing systems | - |
dc.subject.keywordPlus | Activity time | - |
dc.subject.keywordPlus | Attack target | - |
dc.subject.keywordPlus | Cyber threats | - |
dc.subject.keywordPlus | Cyber-attacks | - |
dc.subject.keywordPlus | Malicious codes | - |
dc.subject.keywordPlus | NAtural language processing | - |
dc.subject.keywordPlus | Processing procedures | - |
dc.subject.keywordPlus | SyntaxNet | - |
dc.subject.keywordPlus | Malware | - |
dc.description.journalRegisteredClass | scopus | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
Soongsil University Library 369 Sangdo-Ro, Dongjak-Gu, Seoul, Korea (06978)02-820-0733
COPYRIGHT ⓒ SOONGSIL UNIVERSITY, ALL RIGHTS RESERVED.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.