Network attack knowledge inference with graph convolutional networks and convolutional 2D KG embeddings

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Network Security

Background:

• Analyzing large-scale penetration attacks with complex multi-relational and multi-hop paths presents significant challenges.
• Existing methods struggle with effective association mining of implicit network attack knowledge.

Purpose of the Study:

• To propose KGConvE, a graph convolutional neural network-based method for intelligent reasoning and association mining of implicit network attack knowledge.
• To enhance the accuracy and generalization capability of attack classification and inference tasks.

Main Methods:

• Obtained knowledge embeddings for Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE), and Common Attack Pattern Enumeration and Classification (CAPEC).
• Constructed attack context feature data and a relation matrix using these embeddings.
• Employed a graph convolutional neural network (GCN) for attack classification and the KGConvE model for attack inference.

Main Results:

• Significantly enhanced accuracy and generalization capability in attack classification through GCN improvements.
• Successfully inferred implicit relationships between CVE-CVE, CVE-CWE, and CVE-CAPEC.
• Achieved a Mean Reciprocal Rank (MRR) of 0.68 and Hits@10 of 0.58 in network attack knowledge inference tasks, outperforming baseline methods.

Conclusions:

• KGConvE effectively infers implicit relationships within network attack knowledge.
• The proposed method offers a significant performance improvement for network attack knowledge inference.
• This study is the first to apply the KGConvE model for attack inference tasks.