Named-Entity-Recognition-Based Automated System for Diagnosing Cybersecurity Situations in IoT Networks

Area of Science:

• Cybersecurity
• Natural Language Processing
• Internet of Things (IoT) Security

Background:

• Security management experts face challenges with large volumes of unstructured, natural language security data.
• Keeping up-to-date with evolving security threats, vulnerabilities, and attacks is time-consuming and difficult.
• Existing methods for diagnosing IoT vulnerabilities are often manual and inefficient.

Purpose of the Study:

• To enhance the diagnosis and detection of vulnerabilities in Internet of Things (IoT) systems.
• To develop a semantic indexing solution for existing vulnerabilities, serving as an information tool for security experts.
• To achieve a high rate of automation for a self-maintained and up-to-date system regarding vulnerabilities and common exposures knowledge.

Main Methods:

• Utilized Named Entity Recognition (NER) techniques integrated with ontologies for automated analysis.
• Developed an NER model trained on 312 Common Vulnerabilities and Exposures (CVEs) specific to the IoT field.
• Implemented a domain ontology for IoT security taxonomies to process natural language and identify relevant entities and relations.

Main Results:

• The proposed system effectively identifies key entities and relations relevant to IoT security from natural language data.
• A semantic gateway was developed, capable of context-aware searches within a modeled IoT security database.
• The system can identify potential IoT vulnerabilities before they are exploited, improving proactive security.

Conclusions:

• The integration of NER and ontologies offers a powerful, automated approach to managing IoT security vulnerabilities.
• The semantic indexing solution provides an efficient information tool for security management experts.
• The developed system enhances the ability to proactively discover and mitigate IoT device vulnerabilities.