网络攻击每年造成数十亿美元损失，恶意黑客常在地下论坛分享漏洞利用代码和技巧。识别哪些组织成为这些漏洞的目标对于主动的网络威胁情报（CTI）至关重要。为填补这一空白，我们提出基于CySecBERT的Temporal Representation and Classification of Exploits（TRACE）框架，通过联合优化组织目标分类和供应商一致的表示，同时评估时间分布偏移下的鲁棒性。与以往仅限于小规模、单一来源数据集的工作不同，我们利用大规模、多来源语料库，涵盖9个漏洞数据库和黑客论坛，包含352,866条跨越三十年的帖子，生成包含七个组织类别的129,126样本数据集。在时间分布偏移评估中，TRACE在宏F1值上达到97.00%，显著优于17种经典机器学习方法、深度学习与GloVe/FastText嵌入以及预训练Transformer模型。
英文摘要：
Cyberattacks cause billions of dollars in damage annually, with malicious hackers often sharing exploit code and techniques on underground forums. Identifying which organizations are targeted by these exploits is critical for proactive Cyber Threat Intelligence (CTI). To address that gap, we propose Temporal Representation and Classification of Exploits (TRACE), a vendor-conditioned contrastive learning framework built on CySecBERT that jointly optimizes organizational target classification and vendor-coherent representations while evaluating robustness under temporal distribution shift. Unlike prior work limited to small, single-source datasets, we leverage a large-scale, multi-source corpus spanning 9 exploit databases and hacker forums, comprising 352,866 posts collected over three decades, yielding a 129,126-sample dataset across seven organizational categories. In the temporal out-of-distribution evaluation, TRACE achieves macro F1=97.00\%, substantially outperforming 17 benchmark classical ML methods, deep learning with GloVe/FastText embeddings, and pretrained transformer models.
Exploring the darknet can be a daunting task; this paper explores the application of data mining the darknet within a Canadian cybercrime perspective. Measuring activity through marketplace analysis and vendor attribution has proven difficult in the past. Observing different aspects of the darknet and implementing methods of monitoring and collecting data in the hopes of connecting contributions to the darknet marketplaces to and from Canada. The significant findings include a small Canadian presence, measured the product categories, and attribution of one cross-marketplace vendor through data…
As Critical National Infrastructures are becoming more vulnerable to cyber attacks, their protection becomes a significant issue for any organization as well as a nation. Moreover, the ability to attribute is a vital element of avoiding impunity in cyberspace. In this article, we present main threats to critical infrastructures along with protective measures that one nation can take, and which are classified according to legal, technical, organizational, capacity building, and cooperation aspects. Finally we provide an overview of current methods and practices regarding cyber attribution and c…
Cyber Threat hunting is a proactive search for known attack behaviors in the organizational information system. It is an important component to mitigate advanced persistent threats (APTs). However, the attack behaviors recorded in provenance data may not be completely consistent with the known attack behaviors. In this paper, we propose DeepHunter, a graph neural network (GNN) based graph pattern matching approach that can match provenance data against known attack behaviors in a robust way. Specifically, we design a graph neural network architecture with two novel networks: attribute embeddin…
Sharing of security data across organizational boundaries has often been advocated as a promising way to enhance cyber threat mitigation. However, collaborative security faces a number of important challenges, including privacy, trust, and liability concerns with the potential disclosure of sensitive data. In this paper, we focus on data sharing for predictive blacklisting, i.e., forecasting attack sources based on past attack information. We propose a novel privacy-enhanced data sharing approach in which organizations estimate collaboration benefits without disclosing their datasets, organize…
A smart city is a place where existing facilities and services are enhanced by digital technology to benefit people and companies. The most critical infrastructures in this city are interconnected. Increased data exchange across municipal domains aims to manage the essential assets, leading to more automation in city governance and optimization of the dynamic offered services. However, no clear guideline or standard exists for modeling these data flows. As a result, operators, municipalities, policymakers, manufac-turers, solution providers, and vendors are forced to accept systems with limite…
The dynamics of cyber threats are increasingly complex, making it more challenging than ever for organizations to obtain in-depth insights into their cyber security status. Therefore, organizations rely on Cyber Situational Awareness (CSA) to support them in better understanding the threats and associated impacts of cyber events. Due to the heterogeneity and complexity of cyber security data, often with multidimensional attributes, sophisticated visualization techniques are needed to achieve CSA. However, there have been no previous attempts to systematically review and analyze the scientific …
