Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
PreprintCited by 1

The DOI matches its DataCite record.

Generating Fake Cyber Threat Intelligence Using Transformer-Based Models

Ranade, Priyanka, Piplai, Aritran, Mittal, Sudip, Joshi, Anupam, Finin, Tim·2021·arXiv
DOI 10.48550/arxiv.2102.04351arXiv 2102.04351
Open this paper in CoChat — free account

Abstract

Cyber-defense systems are being developed to automatically ingest Cyber Threat Intelligence (CTI) that contains semi-structured data and/or text to populate knowledge graphs. A potential risk is that fake CTI can be generated and spread through Open-Source Intelligence (OSINT) communities or on the Web to effect a data poisoning attack on these systems. Adversaries can use fake CTI examples as training input to subvert cyber defense systems, forcing the model to learn incorrect inputs to serve their malicious needs. In this paper, we automatically generate fake CTI text descriptions using transformers. We show that given an initial prompt sentence, a public language model like GPT-2 with fine-tuning, can generate plausible CTI text with the ability of corrupting cyber-defense systems. We utilize the generated fake CTI text to perform a data poisoning attack on a Cybersecurity Knowledge Graph (CKG) and a cybersecurity corpus. The poisoning attack introduced adverse impacts such as returning incorrect reasoning outputs, representation poisoning, and corruption of other dependent AI-based cyber defense systems. We evaluate with traditional approaches and conduct a human evaluation study with cybersecurity professionals and threat hunters. Based on the study, professional threat hunters were equally likely to consider our fake generated CTI as true.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2102.04351

Cites

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

No references could be resolved yet.

Research works printed but not linked: 40

  1. Cynthia Wagner, Alexandre Dulaunoy, Gérard Wagener, and Andras Iklody. Misp: The design and implementation of a collaborative threat intelligence sharing platform. In Workshop on Information Sharing and Collaborative Security, pages 49-56. ACM, 2016.
  2. Sudip Mittal, Prajit Das, Varish Mulwad, Anupam Joshi, and Tim Finin. Cybertwitter: Using twitter to generate alerts for cybersecurity threats and vulnerabilities. IEEE/ACM Int. Conf. on Advances in Social Networks Analysis and Mining, pages 860-867, 2016.
  3. Sudip Mittal, Anupam Joshi, and Tim Finin. Cyber-all-intel: An AI for security related threat intelligence. arXiv:1905.02895, 2019. · arXiv
  4. Sudip Mittal, Anupam Joshi, and Tim Finin. Thinking, fast and slow: Combining vector spaces and knowledge graphs. arXiv:1708.03310, 2017. · arXiv
  5. Lorenzo Neil, Sudip Mittal, and Anupam Joshi. Mining threat intel- ligence about open-source projects and libraries from code repository issues and bug reports. In Intelligence and Security Informatics. IEEE, 2018.
  6. Priyanka Ranade, Sudip Mittal, Anupam Joshi, and Karuna Joshi. Using deep neural networks to translate multi-lingual threat intelligence. In International Conference on Intelligence and Security Informatics, pages 238-243. IEEE, 2018.
  7. Priyanka Ranade, Sudip Mittal, Anupam Joshi, and Karuna Pande Joshi. Understanding multi-lingual threat intelligence for AI based cyber- defense systems. In IEEE International Symposium on Technologies for Homeland Security, 2018.
  8. Sagar Samtani, Hongyi Zhu, and Hsinchun Chen. Proactively identifying emerging hacker threats from the dark web: A diachronic graph embed- ding framework (d-gef). ACM Transactions on Privacy and Security (TOPS), 23(4):1-33, 2020.
  9. Nolan Arnold, Mohammadreza Ebrahimi, Ning Zhang, Ben Lazarine, Mark Patton, Hsinchun Chen, and Sagar Samtani. Dark-net ecosystem cyber-threat intelligence (cti) tool. In International Conference on Intelligence and Security Informatics, pages 92-97. IEEE, 2019.
  10. Sandeep Narayanan, Ashwini Ganesan, Karuna Joshi, Tim Oates, Anu- pam Joshi, and Tim Finin. Early detection of cybersecurity threats using collaborative cognition. In 2018 IEEE 4th International Conference on Collaboration and Internet Computing (CIC), pages 354-363, 2018.
  11. Nitika Khurana, Sudip Mittal, Aritran Piplai, and Anupam Joshi. Pre- venting poisoning attacks on AI based threat intelligence systems. In 29th Int. Workshop on Machine Learning for Signal Processing, pages 1-6. IEEE, 2019.
  12. Michele Maasberg, Emmanuel Ayaburi, Charles Liu, and Yoris Au. Ex- ploring the propagation of fake cyber news: An experimental approach. In 51st Hawaii International Conference on System Sciences, 2018.
  13. Yevgeniy Vorobeychik and Murat Kantarcioglu. Adversarial machine learning. Synthesis Lectures on Artificial Intelligence and Machine Learning, 12(3):1-169, 2018.
  14. Aditya Grover and Jure Leskovec. node2vec: Scalable feature learning for networks. In 22nd ACM SIGKDD international conference on Knowledge discovery and data mining, pages 855-864, 2016.
  15. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language un- derstanding. arXiv:1810.04805, 2018. · arXiv
  16. Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in neural information processing systems, pages 5998-6008, 2017.
  17. Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9, 2019.
  18. Qiang Wang, Bei Li, Tong Xiao, Jingbo Zhu, Changliang Li, Derek F Wong, and Lidia S Chao. Learning deep transformer models for machine translation. arXiv:1906.01787, 2019. · arXiv
  19. Taihua Shao, Yupu Guo, Honghui Chen, and Zepeng Hao. Transformer- based neural network for answer selection in question answering. IEEE Access, 7:26146-26156, 2019.
  20. Yang Liu and Mirella Lapata. Text summarization with pretrained en- coders. In Conf. on Empirical Methods in Natural Language Processing and the 9th Int. Joint Conf. on Natural Language Processing, pages 3721-3731. ACL, 2019.
  21. Tom B Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, and Amanda Askell. Language models are few-shot learners. arXiv:2005.14165, 2020. · arXiv
  22. Jieh-Sheng Lee and Jieh Hsiang. Patent claim generation by fine-tuning OpenAI GPT-2. arXiv:1907.02052, 2019. · arXiv
  23. Steven Y Feng, Varun Gangal, Dongyeop Kang, Teruko Mitamura, and Eduard Hovy. Genaug: Data augmentation for finetuning text genera- tors. In Deep Learning Inside Out (DeeLIO): The First Workshop on Knowledge Extraction and Integration for Deep Learning Architectures, pages 29-42, 2020.
  24. Michela Del Vicario, Alessandro Bessi, Fabiana Zollo, Fabio Petroni, Antonio Scala, Guido Caldarelli, H Eugene Stanley, and Walter Quat- trociocchi. The spreading of misinformation online. Proceedings of the National Academy of Sciences, 113(3):554-559, 2016.
  25. Rutvik Vijjali, Prathyush Potluri, Siddharth Kumar, and Sundeep Teki. Two stage transformer model for COVID-19 fake news detection and fact checking. arXiv:2011.13253, 2020. · arXiv
  26. Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. Defending against neural fake news. In Advances in neural information processing systems, pages 9054-9065, 2019.
  27. Aditya Pingle, Aritran Piplai, Sudip Mittal, Anupam Joshi, James Holt, and Richard Zak. Relext: Relation extraction using deep learning approaches for cybersecurity knowledge graph improvement. IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining, 2019.
  28. Aritran Piplai, Sudip Mittal, Anupam Joshi, Tim Finin, James Holt, and Richard Zak. Creating cybersecurity knowledge graphs from malware after action reports. IEEE Access, 8:211691-211703, 2020.
  29. Peng Gao, Xiaoyuan Liu, Edward Choi, Bhavna Soman, Chinmaya Mishra, Kate Farris, and Dawn Song. A system for automated open- source threat intelligence gathering and management. arXiv preprint arXiv:2101.07769, 2021. · arXiv
  30. Jing Liu, Yuan Wang, and Yongjun Wang. The similarity analysis of malicious software. In Int. Conf. on Data Science in Cyberspace. IEEE, 2016.
  31. Younghee Park, Douglas Reeves, Vikram Mulukutla, and Balaji Sun- daravel. Fast malware classification by automated behavioral graph matching. In 6th Annual Workshop on Cyber Security and Information Intelligence Research. ACM, 2010.
  32. Blake Anderson, Daniel Quist, Joshua Neil, Curtis Storlie, and Terran Lane. Graph-based malware detection using dynamic analysis. Journal in Computer Virology, 7(1):247-258, 2011.
  33. Karuna P Joshi, Aditi Gupta, Sudip Mittal, Claudia Pearce, Anupam Joshi, and Tim Finin. Alda: Cognitive assistant for legal document analytics. In AAAI Fall Symposium, 2016.
  34. Maithilee Joshi, Sudip Mittal, Karuna P Joshi, and Tim Finin. Semanti- cally rich, oblivious access control using ABAC for secure cloud storage. In Int. Conf. on edge computing, pages 142-149. IEEE, 2017.
  35. Aritran Piplai, Sudip Mittal, Mahmoud Abdelsalam, Maanak Gupta, Anupam Joshi, and Tim Finin. Knowledge enrichment by fusing repre- sentations for malware threat intelligence and behavior. In International Conference on Intelligence and Security Informatics. IEEE, 2020.
  36. Aritran Piplai, Priyanka Ranade, Anantaa Kotal, Sudip Mittal, Sandeep Narayanan, and Anupam Joshi. Using Knowledge Graphs and Re- inforcement Learning for Malware Analysis. In 4th International Workshop on Big Data Analytics for Cyber Intelligence and Defense, IEEE International Conference on Big Data. IEEE, December 2020.
  37. Anthony D Joseph, Blaine Nelson, Benjamin IP Rubinstein, and JD Ty- gar. Adversarial Machine Learning. Cambridge University Press, 2019.
  38. Vasisht Duddu. A survey of adversarial machine learning in cyber warfare. Defence Science Journal, 68(4), 2018.
  39. Peng Gao, Fei Shao, Xiaoyuan Liu, Xusheng Xiao, Haoyuan Liu, Zheng Qin, Fengyuan Xu, Prateek Mittal, Sanjeev R Kulkarni, and Dawn Song. A system for efficiently hunting for cyber threats in computer systems using threat intelligence. arXiv preprint arXiv:2101.06761, 2021. · arXiv
  40. Gulshan Kumar, Krishan Kumar, and Monika Sachdeva. The use of artificial intelligence based techniques for intrusion detection: a review. Artificial Intelligence Review, 34(4):369-387, 2010.

Cited by

Metadata

Authors
Ranade, P., Piplai, A., Mittal, S., Joshi, A., & Finin, T.
Venue
arXiv
Publisher
arXiv
Published
2021
DOI
10.48550/arxiv.2102.04351
arXiv
2102.04351
References
0
Type
Preprint
Licence
creativecommons.org/licenses/by-nc-nd/4.0/legalcode

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review