Proactive Ontology-based Cyber Threat Intelligence Analytic

Abstract

Exploiting Cyber Threat Intelligence (CTI) as a valuable, updated, and structured source of information on threats and vulnerabilities can be a strong support for providing effective cybersecurity solutions. CTIs are shared across dedicated online platforms via a machine-readable format, such as Structured Threat Information eXpression (STIX). Meanwhile, ontology-based semantic knowledge modeling has become a promising solution that provides a machine-readable language for downstream work to address cybersecurity issues. Hence, by incorporating STIX concepts we propose in this paper an ontological-based CTI analysis that provides valuable threats information according to the security alerts reported by an analyzer. To test our ontology, we developed a set of reasoning rules to infer new knowledge on cyber threats. The experimental results show that such knowledge can be inferred by applying our approach for an ongoing and effective monitoring of cyber threats.