KRYSTAL: Knowledge graph-based framework for tactical attack discovery in audit data

Kabul Kurniawan

doi:10.1016/j.cose.2022.102828

Return

KRYSTAL: Knowledge graph-based framework for tactical attack discovery in audit data

2022-10-01

PRE

DOI：10.1016/j.cose.2022.102828

Original

Original request for help

Save

Abstract

En 中文

Attack graph-based methods are a promising approach towards discovering attacks and various techniques have been proposed recently. A key limitation, however, is that approaches developed so far are monolithic in their architecture and heterogeneous in their internal models. The inflexible custom data models of existing prototypes and the implementation of rules in code rather than declarative languages on the one hand make it difficult to combine, extend, and reuse techniques, and on the other hand hinder reuse of security knowledge - including detection rules and threat intelligence. KRYSTAL tackles these challenges by providing a knowledge graph-based, modular framework for threat detection, attack graph and scenario reconstruction, and analysis based on RDF as a standard model for knowledge representation. This approach provides query options that facilitate contextualization over internal and external background knowledge, as well as the integration of multiple detection techniques, including tag propagation, attack signatures, and graph queries. We implemented our framework in an openly available prototype and demonstrate its applicability on multiple scenarios of the DARPA Transparent Computing dataset. Our evaluation shows that the combination of different threat detection techniques within our framework improved detection capabilities. Furthermore, we find that RDF provenance graphs are scalable and can efficiently support a variety of threat detection techniques. (C) 2022 The Author(s). Published by Elsevier Ltd.

Keywords:

Attack graph construction

Log analysis

Knowledge graph

Attack discovery

Cybersecurity

Information security