From Words to Intelligence

2023/04/19 by Mouchoux, Ronan, Moerman, François
#Computational cyber threat intelligence #Criminology #FOS: Law #Modus operandi #Natural language processing

paper · doi:10.18464/cybin.v8i1.42

Abstract

This paper proposes a system for collecting and structuring blog articles about cyber-attacks, with the goal of improving the ability of security researchers to compare threat actor modus operandi. By grounding our work in the field of criminology, we also formulate a Cyber Operation Constraint Principle that could inform future research. We derived from it a tool, the AbductionReductor, that has the potential to augment partial knowledge about a threat actor's behaviour while investigating its actions. Our approach has the potential to significantly support cyber threat analysis and investigation. Future research must focus on the challenge of synchrony and diachrony linguistic analysis.

Related

• Threat Trekker: An Approach to Cyber Threat Hunting
• Cyber Threat Hunting: Non-Parametric Mining of Attack Patterns from Cyber Threat Intelligence for Precise Threats Attribution
• A systematic literature review on cyber threat hunting
• Artificial Intelligence for Cybersecurity: Threats, Attacks and Mitigation
• Technique Inference Engine: A Recommender Model to Support Cyber Threat Hunting