Cyber-attack activities are complex and ever-changing, posing severe challenges to cybersecurity personnel. Introducing knowledge graphs into the field of cybersecurity helps depict the intricate cybersecurity landscape and provides technical support for threat identification and situational awareness. However, during the process of constructing knowledge graphs, inevitable noise and conflicts may be introduced, leading to misleading inferences and decisions. This paper aims to address the issues of constructing and assessing the quality of cybersecurity knowledge graphs. We manually constructed a dataset of cybersecurity knowledge graphs (CS13K) and expanded the existing cybersecurity ontology, building a more versatile ontology applicable to existing data features. Building upon this, we utilized Neo4j to construct the cybersecurity knowledge graph. Furthermore, we propose an AttTucker model, based on Transformer, for assessing the quality of knowledge graphs. By employing numerous self-attention heads, this model captures latent information among entities and relations. While reducing the dimensionality of knowledge embeddings, the model achieves evaluation results comparable to high-dimensional embeddings. Finally, we incorporate the path-level information between entities in the knowledge graph into the evaluation of knowledge graph quality based on the AttTucker model. Experimental analysis on both generic datasets and cybersecurity datasets demonstrates that our model significantly improves F1 value and accuracy in knowledge graph quality assessment tasks, outperforming other models.

Relation classification is a significant task within the field of natural language processing. Its objective is to extract and identify relations between two entities in a given text. Within the scope of this paper, we construct an artificial dataset (CS13K) for relation classification in the realm of cybersecurity and propose two models for processing such tasks. For any sentence containing two target entities, we first locate the entities and fine-tune the pre-trained BERT model. Next, we utilize graph attention networks to iteratively update word nodes and relation nodes. A new relation classification model is constructed by concatenating the updated vectors of word nodes and relation nodes. Our proposed model achieved exceptional performance on the SemEval-2010 task 8 dataset, surpassing previous approaches with a remarkable F1 value of 92.3%. Additionally, we propose the integration of a ranking-based voting mechanism into the existing model. Our best results are an F1 value of 92.5% on the SemEval-2010 task 8 dataset and a value 94.6% on the CS13K dataset. These findings highlight the effectiveness of our proposed models in tackling relation classification tasks.

As an advanced knowledge management and reasoning tool, knowledge graph technology can significantly enhance the efficiency of managing and analyzing cyberthreat intelligence, providing strong technical support for cybersecurity threat identification and situational awareness. This paper proposes a multi-level graph clustering-based model for completing cyberthreat intelligence knowledge graphs (GCCKG). The model utilizes a multi-level graph clustering approach to divide the knowledge graph into communities and selects a portion of high-degree entities within each community as the reserved entities. Additionally, we propose a path-enhanced cosine similarity measurement method to measure the similarity between entities, and a graph attention network is employed to iteratively update the embeddings of entities and relations, capturing key information in the graph-structured data. Experimental results demonstrate that the proposed GCCKG model significantly improves evaluation values such as MRR and Hits@K in knowledge graph completion tasks on several general domain knowledge graphs, including FB15K, WN18, FB15K-237, as well as the cyberthreat intelligence knowledge graph CS13K, while also significantly reducing the model’s parameter size. This provides a novel solution for knowledge graph completion in the field of cyberthreat intelligence.

As the forms of cyber threats become increasingly severe, cybersecurity knowledge graphs (KGs) have become essential tools for understanding and mitigating these threats. However, the quality of the KG is critical to its effectiveness in cybersecurity applications. In this paper, we propose a spurious-negative sample augmentation-based quality evaluation method for cybersecurity KGs (SNAQE) that includes two key modules: the multi-scale spurious-negative triple detection module and the adaptive mixup based on the attention mechanism module. The multi-scale spurious-negative triple detection module classifies the sampled negative triples into spurious-negative and true-negative triples. Subsequently, the attention mechanism-based adaptive mixup module selects appropriate mixup targets for each spurious-negative triple, constructing partially correct triples and achieving more precise sample generation in the entity embedding space to assist in training the KG quality evaluation models. Through extensive experimental validation, the SNAQE model not only performs excellently in general-domain KG quality evaluation but also achieves outstanding outcomes in the cybersecurity KGs, significantly enhancing the accuracy and F1 score of the model, with the best F1 score of 0.969 achieved on the FB15K dataset.