Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Proactive security defense: cyber threat intelligence modeling for connected autonomous vehicles

Yinghui Wang, Yilong Ren, Zhiyong Cui, Haiyang Yu

TL;DR

An automotive CTI modeling framework, Actim, to extract and analyse the interrelated relationships among cyber threat elements, and enables mining the intrinsic connections among threat entities, providing valuable insight on the evolving cyber threat landscape.

Abstract

Cybersecurity has become a crucial concern in the field of connected autonomous vehicles. Cyber threat intelligence (CTI), as the collection of cyber threat information, offers an ideal way for responding to emerging cyber threats and realizing proactive security defense. However, instant analysis and modeling of vehicle cybersecurity data is a fundamental challenge since its complex and professional context. In this paper, we suggest an automotive CTI modeling framework, Actim, to extract and analyse the interrelated relationships among cyber threat elements. Specifically, we first design a vehicle security-safety conceptual ontology model to depict various threat entity classes and their relations. Then, we manually annotate the first automobile CTI corpus by using real cybersecurity data, which comprises 908 threat intelligence texts, including 8195 entities and 4852 relationships. To effectively extract cyber threat entities and their relations, we propose an automotive CTI mining model based on cross-sentence context. Experiment results show that the proposed BERT-DocHiatt-BiLSTM-LSTM model exceeds the performance of existing methods. Finally, we define entity-relation matching rules and create a CTI knowledge graph that structurally fuses various elements of cyber threats. The Actim framework enables mining the intrinsic connections among threat entities, providing valuable insight on the evolving cyber threat landscape.

Proactive security defense: cyber threat intelligence modeling for connected autonomous vehicles

TL;DR

An automotive CTI modeling framework, Actim, to extract and analyse the interrelated relationships among cyber threat elements, and enables mining the intrinsic connections among threat entities, providing valuable insight on the evolving cyber threat landscape.

Abstract

Cybersecurity has become a crucial concern in the field of connected autonomous vehicles. Cyber threat intelligence (CTI), as the collection of cyber threat information, offers an ideal way for responding to emerging cyber threats and realizing proactive security defense. However, instant analysis and modeling of vehicle cybersecurity data is a fundamental challenge since its complex and professional context. In this paper, we suggest an automotive CTI modeling framework, Actim, to extract and analyse the interrelated relationships among cyber threat elements. Specifically, we first design a vehicle security-safety conceptual ontology model to depict various threat entity classes and their relations. Then, we manually annotate the first automobile CTI corpus by using real cybersecurity data, which comprises 908 threat intelligence texts, including 8195 entities and 4852 relationships. To effectively extract cyber threat entities and their relations, we propose an automotive CTI mining model based on cross-sentence context. Experiment results show that the proposed BERT-DocHiatt-BiLSTM-LSTM model exceeds the performance of existing methods. Finally, we define entity-relation matching rules and create a CTI knowledge graph that structurally fuses various elements of cyber threats. The Actim framework enables mining the intrinsic connections among threat entities, providing valuable insight on the evolving cyber threat landscape.

Paper Structure

This paper contains 19 sections, 7 equations, 8 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Motivation
  3. Contributions
  4. Related work
  5. Automotive cybersecurity conceptual ontology
  6. Cyber threat intelligence modeling
  7. Architecture Overview of Actim
  8. Preliminaries
  9. System Architecture
  10. Methodology
  11. CTI ontology model construction
  12. Entity definition of the VSS ontology
  13. Relationship model between entity classes
  14. Cyber entity-relation joint extraction model
  15. Experimental Evaluation
  16. ...and 4 more sections

Figures (8)

  • Figure 1: The system architecture of Actim. Actim includes three main components: (a) collecting automotive cybersecurity data and modeling CTI ontology; (b) annotating CTI corpus and extracting threat entities and their relationships; and (c) constructing an automotive CTI knowledge graph by leveraging Neo4j.
  • Figure 2: Vehicle security-safety conceptual ontology.
  • Figure 3: Intersection of the security and safety domains.
  • Figure 4: BERT-DocHiatt-BiLSTM-LSTM model.
  • Figure 5: Brat manual annotation.
  • ...and 3 more figures