Malware Knowledge Graph Generation

TL;DR

This paper introduces TINKER, a novel open-source knowledge graph for cybersecurity threat intelligence, generated from unstructured threat reports to facilitate better understanding and prediction of cyber threats.

Contribution

The paper presents the creation of TINKER, the first open-source security knowledge graph built from natural language threat reports using malware ontology and RDF triples.

Findings

TINKER contains RDF triples from 83 threat reports (2006-2021).

It demonstrates the feasibility of converting unstructured threat data into a structured knowledge graph.

Challenges in ontology alignment and data annotation are discussed.

Abstract

Cyber threat and attack intelligence information are available in non-standard format from heterogeneous sources. Comprehending them and utilizing them for threat intelligence extraction requires engaging security experts. Knowledge graphs enable converting this unstructured information from heterogeneous sources into a structured representation of data and factual knowledge for several downstream tasks such as predicting missing information and future threat trends. Existing large-scale knowledge graphs mainly focus on general classes of entities and relationships between them. Open-source knowledge graphs for the security domain do not exist. To fill this gap, we've built \textsf{TINKER} - a knowledge graph for threat intelligence (\textbf{T}hreat \textbf{IN}telligence \textbf{K}nowl\textbf{E}dge g\textbf{R}aph). \textsf{TINKER} is generated using RDF triples describing entities and relations from tokenized unstructured natural language text from 83 threat reports published between 2006-2021. We built \textsf{TINKER} using classes and properties defined by open-source malware ontology and using hand-annotated RDF triples. We also discuss ongoing research and challenges faced while creating \textsf{TINKER}.