Leveraging knowledge graph techniques to detect and analyze cyber attacks is a promising research direction at the interface between the semantic web and security research communities. In this paper, we build on prior work and develop a vocabulary to extend a cybersecurity knowledge graph with adversary tactics and techniques. Using this vocabulary, we represent rich threat intelligence instance data from MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) in a knowledge graph. This knowledge can be used to contextualize indicators of compromise from log messages, identify potential attack steps, and link them to cybersecurity knowledge. To demonstrate the bene ts of the approach, we link low-level threat alerts produced by community rules to the cybersecurity knowledge graph.
Cybersecurity Threat Intelligence (CTI) can help defenders to identify
vulnerabilities, understand malware behavior, and contextualize attack patterns.
ATT&CK3, published by MITRE, is a well-established source of such
intelligence; it provides a taxonomy and instance knowledge for adversary tactics and
techniques curated from real-world observations. ATT&CK supports various
security use cases from the adversary and defender perspective, such as adversary
emulation, red teaming, defensive gap assessment, identi cation and modeling
of adversary behavior [
Although such CTI resources can be very useful for security experts, they
are also typically di cult to relate to other cybersecurity information and
operational data and not suitable for querying and automated machine
interpre? Copyright © 2021 for this paper by its authors. Use permitted under Creative Commons
License Attribution 4.0 International (CC BY 4.0). This work was sponsored by the Austrian
Science Fund (FWF) and netidee SCIENCE under grant P30437-N31. The competence
center SBA Research (SBA-K1) is funded within the framework of COMET | Competence
Centers for Excellent Technologies by BMVIT, BMDW, and the federal state of Vienna,
managed by the FFG. The authors thank the funders for their generous support.
3 https://attack.mitre.org/matrices/enterprise/
tation [
We ll this gap by developing a standard model for ATT&CK based on RDF-S11 and OWL12, and integrate its instance data into the SEPSES CSKG. To identify high-level attack steps while abstracting from low-level indicators, we introduce a method to (i) translate community-based threat detection rules from sources such as Sigma13 into SPARQL queries and (ii) to link the alerts they produce to adversarial tactics and techniques de ned in ATT&CK. Figure 1 illustrates the resulting overall process to link cybersecurity attacks to adversary tactics and techniques. 4 Structured Threat Information Expression, https://stixproject.github.io/ 5 Cyber Observable eXpression, https://cyboxproject.github.io/ 6 Common Vulnerability Exposure, https://cve.mitre.org/ 7 Common Attack Pattern Enumeration and Classi cation, https://capec.mitre.org/ 8 Common Event Expression, https://cee.mitre.org/language/syntax.html 9 Common Vulnerability Scoring System, https://www.first.org/cvss/ 10 Common Weakness Enumeration, https://cwe.mitre.org/ 11 Resource Description Framework Schema, https://www.w3.org/TR/rdf-schema/ 12 Web Ontology Language, https://www.w3.org/TR/owl-features/ 13 Sigma rule repository, https://github.com/SigmaHQ/sigma 2
We rst de ned an ontology based on the existing schema by MITRE to
represent and publish attack data [
Fig. 2: An extended SEPSES CSKG Ontology with ATT&CK sulting ATT&CK ontology14. The ontology consists of ve main classes (i.e., Tactic, Technique, Mitigation, AdversaryGroup, and Software) and a set of data and object properties. The Tactic class represents tactical adversary goals during the attack, whereas a Technique represents how an adversary achieves the tactical objective; the att:accomplishesTactic property links Techniques and Tactics. Techniques may have more speci c sub-techniques; to this end, the att:isSubTechnique property can be used to self-link the Technique class. Mitigation represents measures that can be used to prevent Techniques from being executed. We de ned the att:preventsTechnique property to link between mitigations and Techniques. The AdversaryGroup represents a threat/actor group that typically represents persistent threat activity. The att:usesTechnique property links the group to the Technique class. Software represent software/tools that are used to implement a Technique, which is expressed via the property att:implementsTechnique. We also de ned several inverse properties such as at:hasMitigation, hasTechnique, hasSoftware, etc. Furthermore, Technique links to the existing CAPEC attack pattern knowledge in the SEPSES CSKG via the att:hasCAPEC property.
We used RML16, a declarative RDF mapping language to map and transform MITRE ATT&CK resources17 into RDF based on the developed ATT&CK ontology. The constructed RDF graphs are automatically stored in a triplestore together with the existing SEPSES CSKG and integrated with information from 14 https://w3id.org/sepses/vocab/ref/attack 15 As per August 2, 2021 (cf. https://w3id.org/sepses/dumps/attack). 16 RDF Mapping Language, https://rml.io/ 17 MITRE publishes the ATT&CK resource in a JSON format #Axiom 61 #Class 5 #ObjectProperty 10 #DataProperty 7 #Individual 4054 other standards, such as CAPEC, CVE, CWE, CPE18 and CVSS (see Figure 3 steps (1) and (2)). Table 1 provides summary statistics on the elements currently in the ATT&CK knowledge graph. 3
We implemented the threat detection concept introduced in Section 1 using Sigma, an open, community-driven, and generic rule format for threat detection in logs and included them in our threat detection pipeline. Sigma provides more than 95019 rules/signatures (written in a YAML) for di erent log sources (e.g., application, network, web logs) and platforms (e.g Linux & Windows).
Figure 3 shows an example; based on the Sigma rule speci cation20, we translate the existing Sigma rules into SPARQL queries and also transform other rule metadata (e.g. title, description, log source, and tags21) into RDF (3).
The translated rules can then be used to detect Indicators of Compromise (IoCs) in RDF log graphs22 (4). Once detected, the respected alert will automatically be linked to the corresponding attack technique in the ATT&CK knowledge graph (5).
As we can see, the execution of /tmp/vUgefal located in /tmp/ has been detected based on a Sigma rule. Consequently, a Program Execution in Suspicious Folder alert has been raised. The detected alert is automatically linked to the T1204.002 23 (User Execution: Malicious File ) technique in the ATT&CK knowledge graph, as it is identi ed in the Sigma rule (see tags value). Finally, an analyst can further explore and integrate additional information from the ATT&CK knowledge graph (e.g. via SPARQL Query federation) as de ned in the ontology (e.g. tactics, mitigations, adversary group, and attack patterns (CAPEC)). 4
In this paper, we extended the SEPSES CSKG with threat intelligence from
MITRE ATT&CK and used it to link indicators of compromise to adversarial
18 Common Platform Enumeration, https://nvd.nist.gov/products/cpe
19 As per August 2 2021.
20 https://github.com/SigmaHQ/sigma/wiki/Specification
21 tags associates Sigma rules with ATT&CK techniques.
22 Note: tools such as SLOGERT [