Using Machine Learning for Description and Inference of Cyber Threats, Vulnerabilities, and Mitigations

Abstract

Machine learning and natural language processing (NLP) can help describe and make inferences on the vast amount of text data in cybersecurity. We use a graph database named BRON, which contains data from publicly available threat and vulnerability sources, for machine learning inference. Applying machine learning to BRON can provide us with more robust relationships, which can improve defenses against cyber threats. We experiment with different feature representations and subsets of the data, and show that machine learning and NLP can effectively classify edges between entries from different data sources as well as predict possible edge candidates. Experts agree that several of our predicted candidates are plausible edges. We also analyze defensive mitigation similarities using NLP techniques and find that there are identical mitigation descriptions for some entries that have internal relationships.