Vulnerabilities are often accompanied by cyberattacks. CVE is the largest repository of open vulnerabilities, which keeps expanding. ATT&CK models known multi-step attacks both tactically and technically and remains up to date. It is valuable to correlate the vulnerability in CVE with the corresponding tactic and technique of ATT&CK which exploit the vulnerability, for active defense. Mappings manually is not only time-consuming but also difficult to keep up-to-date. Existing language-based automated mapping methods do not utilize the information associated with attack behaviors outside of CVE and ATT&CK and are therefore ineffective. In this paper, we propose a novel framework named VTT-LLM for mapping Vulnerabilities to Tactics and Techniques based on Large Language Models, which consists of a generation model and a mapping model. In order to generate fine-tuning instructions for LLM, we create a template to extract knowledge of CWE (a standardized list of common weaknesses) and CAPEC (a standardized list of common attack patterns). We train the generation model of VTT-LLM by fine-tuning the LLM according to the above instructions. The generation model correlates vulnerability and attack through their descriptions. The mapping model transforms the descriptions of ATT&CK tactics and techniques into vectors through text embedding and further associates them with attacks through semantic matching. By leveraging the knowledge of CWE and CAPEC, VTT-LLM can eventually automate the process of linking vulnerabilities in CVE to the attack techniques and tactics of ATT&CK. Experiments on the latest public dataset, ChatGPT-VDMEval, show the effectiveness of VTT-LLM with an accuracy of 85.18%, which is 13.69% and 54.42% higher than the existing CVET and ChatGPT-based methods, respectively. In addition, compared to fine-tuning without outside knowledge, the accuracy of VTT-LLM with chain fine-tuning is 9.24% higher on average across different LLMs.

In the dynamic landscape of cyberspace, organizations face a myriad of coordinated advanced threats that challenge the traditional defense paradigm. Cyber Threat Intelligence (CTI) plays a crucial role, providing in-depth insights into adversary groups and enhancing the detection and neutralization of complex cyber attacks. However, attributing attacks poses significant challenges due to over-reliance on malware samples or network detection data alone, which falls short of comprehensively profiling attackers. This paper proposes an IPv4-based threat attribution model, IPAttributor, that improves attack characterization by merging a real-world network behavior dataset comprising 39,707 intrusion entries with commercial threat intelligence from three distinct sources, offering a more nuanced context. A total of 30 features were utilized from the enriched dataset for each IP to create a feature matrix to assess the similarities and linkage of associated IPs, and a dynamic weighted threat segmentation algorithm was employed to discern attacker communities. The experiments affirm the efficacy of our method in pinpointing attackers sharing a common origin, achieving the highest accuracy of 88.89%. Our study advances the relatively underexplored line of work of cyber attacker attribution, with a specific interest in IP-based attribution strategies, thereby enhancing the overall understanding of the attacker’s group regarding their capabilities and intentions.

As Internet of Things (IoT) technologies continue to evolve and gain widespread integration across various sectors, IoT devices have become increasingly interconnected and ubiquitous. However, this surge has also led to more sophisticated, diverse, and covert attacks, posing severe security challenges to IoT ecosystems and their defense mechanisms. Intrusion detection systems (IDSs) are instrumental in securing the IoT by uncovering and mitigating malicious behaviors in real time. Nevertheless, the growing complexity of network traffic presents significant challenges for IDS, often resulting in a higher false alarm rate and a lower detection rate, due to the intricate characteristics of space and notable temporal dependencies present in network traffic. We conduct an in-depth dimensionality reduction analysis using the t-distributed stochastic neighbor embedding methodology to examine the relationships among attack examples. Then, to enhance the generalization and robustness of IDS, we propose gated BiLSTM-fused Kolmogorov-Arnold network (GBFKAN), a novel interpretable three-layer network architecture. The structured design of GBFKAN can comprehensively extract and perceive key information from multiple abstract levels in the raw traffic, enhancing the architecture’s generalization ability and robustness. Furthermore, we utilize the Shapley additive explanations method to provide detailed explanations of the detection outcomes, augmenting its credibility. Building on this, we successfully identify the erroneous decision-making paradigms within GBFKAN by incorporating empirical knowledge. Extensive simulation experiments conducted on the four widely recognized intrusion detection datasets have conclusively demonstrated that our proposed GBFKAN model surpasses existing methods in terms of intrusion detection performance.

The rapid advancement of information technologies has significantly intensified the focus on cyberspace security across various sectors. In this evolving landscape, attackers deploy many of techniques- including exploits, weakness identification, and complex multi-step attacks- to gain unauthorized access to systems. Conversely, defenders harness insights from a variety of sources to pinpoint potential threats. Prominent public cybersecurity databases such as the Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK), Common Attack Pattern Enumeration and Classification (CAPEC), Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE), and Common Platform Enumeration (CPE) provide extensive data on security entities and their interrelations, playing a pivotal role in enriching the understanding of cybersecurity challenges and assisting in comprehensive defensive analyses. However, the semantic cross-analysis of these databases, crucial for identifying obscure threat patterns, remains underexploited. In this study, we amalgamate data from these disparate sources into a cohesive threat knowledge graph and introduce a novel knowledge representation learning approach, A4CKGE (ATT&CK-CAPEC-CWE-CVE-CPE Knowledge Graph Embedding). This method utilizes advanced structural and textual analytics to predict interactions among security entities such as products, vulnerabilities, weaknesses, and multi-step attack sequences, employing complex attack templates generated through a Large Language Model (LLM). Our extensive experiments demonstrate that this approach significantly outperforms existing state-of-the-art methods in effectively predicting these relationships. The findings validate the efficacy of our threat knowledge graph in unveiling hidden connections, thereby highlighting its potential to strengthen cybersecurity defenses substantially.

The growing popularity of blockchain technology has underscored the need for robust network security. However, public blockchain networks remain vulnerable to attacks in which adversaries exploit numerous nonfunctional peer connections to disrupt block propagation across the entire network. Inthis article, we propose a practical nontargeted delay attack method and validate its feasibility, scalability, and significant impacts on blockchain networks of varying sizes, including EthereumPoW (ETHW) and premerge Ethereum Mainnet. In the ETHW network with 95 nodes, our adversarial peers introduce delays ranging from 0.33 to 2.8 s for half the nodes, with nearly one-third experiencing delays exceeding 5.9 s, derived from the 90th percentile of delay times. When in the premerge Ethereum network with 5739 nodes, over 80% of peers experience prolonged block propagation, resulting in a 77% increase in delay time, underlining the attacks' scalability and efficacy in large-scale environments. We also optimize the Ethereum client Geth by relaxing certain connection restriction, significantly reducing attack costs. Delving deeper, we analyze the implications of delay attacks on proof-of-work (PoW) and proof-of-stake (PoS) consensus mechanisms, illustrating how attackers can gain extra revenues through such attacks. Specifically, we propose a novel combined strategy to facilitate reorganization attacks under PoS. These findings highlight the urgent need to strengthen network-layer defenses and reinforce peer-to-peer (P2P) network protocol security against real-world delay exploits.