Using Deep Neural Networks to Translate Multi-lingual Threat Intelligence

TL;DR

This paper presents a neural network system designed to translate multilingual cybersecurity threat intelligence into English, addressing privacy concerns and terminology accuracy, thereby aiding analysts and automated defense systems.

Contribution

The authors develop a specialized neural translation system tailored for cybersecurity data, improving privacy and terminology accuracy over general translation engines.

Findings

System successfully translates Russian threat data into English

Generated translations enable better threat analysis and automated response

Pipeline produces RDF and vectorized representations for cybersecurity use

Abstract

The multilingual nature of the Internet increases complications in the cybersecurity community's ongoing efforts to strategically mine threat intelligence from OSINT data on the web. OSINT sources such as social media, blogs, and dark web vulnerability markets exist in diverse languages and hinder security analysts, who are unable to draw conclusions from intelligence in languages they don't understand. Although third party translation engines are growing stronger, they are unsuited for private security environments. First, sensitive intelligence is not a permitted input to third party engines due to privacy and confidentiality policies. In addition, third party engines produce generalized translations that tend to lack exclusive cybersecurity terminology. In this paper, we address these issues and describe our system that enables threat intelligence understanding across unfamiliar languages. We create a neural network based system that takes in cybersecurity data in a different language and outputs the respective English translation. The English translation can then be understood by an analyst, and can also serve as input to an AI based cyber-defense system that can take mitigative action. As a proof of concept, we have created a pipeline which takes Russian threats and generates its corresponding English, RDF, and vectorized representations. Our network optimizes translations on specifically, cybersecurity data.