将漏洞与攻击行为关联，构建可分析的威胁知识图谱。
CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors
- 用Transformer模型从漏洞描述中识别攻击战术和技术
- 构建含24,820实体、43,608关系的标注数据集，技术识别F1达87.71%
- 集成到Neo4j图谱，实现漏洞与攻击行为的可视化关联
在不断演化的威胁环境中，攻击者利用软件漏洞发动复杂攻击，传统防御难以应对。尽管CVE和NVD等数据库提供详细技术信息，但缺乏与攻击者行为（如战术与技术）的关联，限制了威胁解读与响应效率。本文通过连接漏洞与MITRE ATT&CK框架中的行为模式，构建了CVE-TTP知识图谱。采用分类与关系抽取方法，开发基于Transformer的模型进行行为识别，CySecBERT在技术识别上达到87.71%的宏平均F1，战术识别达96.16%。同时构建包含24,820实体和43,608关系的标注数据集。管道式方法在实体抽取上取得0.86的宏平均F1，关系抽取达0.99；联合跨度模型为0.78。最终结果整合至基于Neo4j的网络威胁知识图谱，支持漏洞与攻击行为的结构化可视化。
原文摘要 · Abstract (English)
In the evolving threat landscape, adversaries exploit software vulnerabilities to launch sophisticated attacks, challenging traditional defenses. Although databases like CVE and NVD provide detailed technical information, they often lack links to attacker behaviors such as tactics and techniques, limiting effective threat interpretation and response. This work bridges this gap by connecting vulnerabilities with behavioral patterns from the MITRE ATT&CK framework. We construct a CVE-TTP Knowledge Graph that links CVEs to tactics and techniques using classification and relation extraction. Transformer-based models are developed for behavior identification, with CySecBERT achieving macro F1-scores of 87.71% (techniques) and 96.16% (tactics). Also, we created an annotated dataset with 24,820 entities and 43,608 relations for entity and relation extraction. The pipeline-based approach achieves macro F1-scores of 0.86 (entity extraction) and 0.99 (relation extraction), while a span-based joint model achieves 0.78. These outputs are integrated into a Neo4j-based Cyber Threat Knowledge Graph, enabling structured visualization of vulnerabilities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。