Cybersecurity Entity Alignment via Masked Graph Attention Networks

TL;DR

This paper introduces CEAM, a novel GNN-based model for cybersecurity entity alignment that effectively integrates data from multiple sources, addressing limitations of existing methods and improving threat information consolidation.

Contribution

The paper presents the first cybersecurity-specific entity alignment dataset and a new model, CEAM, with asymmetric masked aggregation and partitioned attention mechanisms.

Findings

CEAM outperforms existing entity alignment methods on cybersecurity datasets.

The dataset reveals unique characteristics of security entities.

CEAM significantly improves threat information integration.

Abstract

Cybersecurity vulnerability information is often recorded by multiple channels, including government vulnerability repositories, individual-maintained vulnerability-gathering platforms, or vulnerability-disclosure email lists and forums. Integrating vulnerability information from different channels enables comprehensive threat assessment and quick deployment to various security mechanisms. Efforts to automatically gather such information, however, are impeded by the limitations of today's entity alignment techniques. In our study, we annotate the first cybersecurity-domain entity alignment dataset and reveal the unique characteristics of security entities. Based on these observations, we propose the first cybersecurity entity alignment model, CEAM, which equips GNN-based entity alignment with two mechanisms: asymmetric masked aggregation and partitioned attention. Experimental results on cybersecurity-domain entity alignment datasets demonstrate that CEAM significantly outperforms state-of-the-art entity alignment methods.