Matching Knowledge Graphs for Cybersecurity Countermeasures Selection

Abstract

As cyberattacks continue to increase, detecting and performing remediation actions m is essential. This paper presents an approach to automate the countermeasures selection process to deal with a vulnerability exploitation performed by a cyberattack. We propose an approach to match two knowledge graphs, one from a vulnerability ontology, Vulnerability Description Ontology (VDO), and the other is the countermeasures knowledge graph, D3FEND, to mitigate cyberattack impacts. Our approach uses machine learning and an inference system to match entities from VDO and D3FEND to select candidate countermeasures to an attack. Our contribution aims to automatically select countermeasures intended to be part of an incident response playbook for a vulnerability. We show our approach application to a WannaCry use-case scenario. We validate our countermeasures selection approach by comparing the countermeasures automatically selected with those proposed in the literature for a WannaCry attack.

Appendix A Additional Background Definitions

Word2Vec. Word2Vec [17] is a popular word embeddings model used to address the limitations of the bag-of-words model [30], which is a type of vector space model that simplifies text data representation in Natural Language Processing (NLP) and Information Retrieval (IR). A bag-of-words vector represents text describing the occurrence of words within a document. In Word2Vec, each token becomes a vector with the length of a determined number.

RDF2Vec. RDF2Vec, created by Ristoski et al. [24], is an unsupervised technique built on Word2Vec. RDF2Vec first creates sentences that can be fed to Word2Vec by extracting walks of a certain depth from a KG to make the embedding. A vector of latent numerical features represents each entity in the KG. We calculate the similarity of the vectors to match their embeddings using a distance metric.

Cosine Similarity. Cosine similarity is a metric for measuring distance when the magnitude of the vectors does not matter. Mathematically, cosine similarity calculates the cosine of the angle between two vectors projected in a multi-dimensional space. Considering two vectors A and B; we can measure their cosine similarity using Formula 1.

$$\begin{aligned} \cos (AB)=\frac{A.B}{||A||||B||} \end{aligned}$$

(1)

where, A.B is the dot product of the vectors A and B, ||A|| and ||B|| are the length (magnitude) of the two vectors A and B, and ||A||||B|| is the regular product of the vectors A and B.

If $A=B$, $\cos (AB)=1$; in this case A and B are fully similar. If $A.B=0$, then A and B are in opposite directions, so A.B is negative, and one or both vectors are zero vectors, $\cos (AB)=0$; in this case A and B are opposite.

Precision. Precision measures the number of positive prediction correctly predicted. So, it is calculated by dividing the number of true positive prediction (TP) by all positive prediction i.e. True Positive (TP) + False Positive (FP).

$$ Precision=\frac{TP}{TP+FP} $$

Recall. Recall gives a percentage of true positives instances by a model. It is the number of well predicted positives divided by the total number of positives (True Positive + False Negative (FN)).

$$ Recall=\frac{TP}{TP+FN} $$

F1 Score. Either precision and recall can not evaluate a machine learning model separately. F1 score allows combining precision and recall. So, it can provide a good evaluation of a model performance. It is calculating as follow:

$$ F1 Score=2 \cdot \frac{Recall \cdot Precision}{Recall + Precision} $$