利用TI Feeds进行漏洞利用检测
Harnessing TI Feeds for Exploitation Detection
AI总结：
针对TI feeds数据量大、结构松散难以人工分析的问题，提出基于Doc2Vec和BERT嵌入建模的机器学习流水线，可自动检测漏洞利用事件，在191个TI feeds上验证有效，可支撑下游漏洞风险评估。
摘要：
许多组织依赖威胁情报（Threat Intelligence，TI）feeds评估与安全威胁相关的风险。由于数据量庞大且具有异构性，手动分析不同松散结构TI feeds中的可用威胁信息是不现实的。因此，需要开发自动化方法来审核并从TI feeds中提取可执行信息。为此，我们提出了一种机器学习流水线，可从TI feeds中自动检测漏洞利用行为。我们首先使用最先进的嵌入技术（Doc2Vec和BERT）对松散结构TI feeds中的威胁词汇进行建模，随后利用该模型训练有监督机器学习分类器，以检测安全漏洞的利用情况。我们使用该方法在191个不同的TI feeds中识别漏洞利用事件。纵向评估表明，该方法仅使用过往数据训练，就能准确识别TI feeds中的漏洞利用事件，甚至对训练中未涉及的TI feeds也有效。我们提出的方法可用于多种下游任务，例如数据驱动的漏洞风险评估。
英文摘要：
Many organizations rely on Threat Intelligence (TI) feeds to assess the risk associated with security threats. Due to the volume and heterogeneity of data, it is prohibitive to manually analyze the threat information available in different loosely structured TI feeds. Thus, there is a need to develop automated methods to vet and extract actionable information from TI feeds. To this end, we present a machine learning pipeline to automatically detect vulnerability exploitation from TI feeds. We first model threat vocabulary in loosely structured TI feeds using state-of-the-art embedding techniques (Doc2Vec and BERT) and then use it to train a supervised machine learning classifier to detect exploitation of security vulnerabilities. We use our approach to identify exploitation events in 191 different TI feeds. Our longitudinal evaluation shows that it is able to accurately identify exploitation events from TI feeds only using past data for training and even on TI feeds withheld from training. Our proposed approach is useful for a variety of downstream tasks such as data-driven vulnerability risk assessment.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
