Co-exploitation behaviour, referring to multiple software vulnerabilities being exploited jointly by one or more exploits, brings enormous challenges to the prevention and remediation of cyber-attacks. Leveraging the latest advances in graph-driven intelligence, this paper formulates vulnerability co-exploitation behaviour discovery as a link prediction problem between vulnerability entities within a vulnerability knowledge graph. We propose a Modality-Aware Graph Convolutional Network (MAGCN) module to embed multi-modality entity attributes and topological graph connectivity features into a unified lower-dimensional feature space to boost link prediction performance. We further design a Graph Knowledge Transfer Learning (GKTL) strategy to transfer knowledge between subgraphs extracted from the same knowledge graph. Experimental results on a real-world dataset containing co-exploitation incidents between 1995 and 2021 show that MAGCN achieved 81.34% on the F1 score when applying the GKTL strategy, superior to other graph neural network modules, such as GCN, GraphSAGE, EdgeGCN and GINGCN.

Knowledge graph, as an extension of graph data structure, is being used in a wide range of areas as it can store interrelated data and reveal interlinked relationships between different objects within a large system. This paper proposes an algorithm to construct an access control knowledge graph from user and resource attributes. Furthermore, an online learning framework for access control decision-making is proposed based on the constructed knowledge graph. Within the framework, we extract topological features to represent high cardinality categorical user and resource attributes. Experimental results show that topological features extracted from knowledge graph can improve the access control performance in both offline learning and online learning scenarios with different degrees of class imbalance status.

While threats from outsiders are easier to alleviate, effective ways seldom exist to handle threats from insiders. The key to managing insider threats lies in engineering behavioral features efficiently and classifying them correctly. To handle challenges in feature engineering, we propose an integrated feature engineering solution based on daily activities, combining manually-selected features and automatically-extracted features together. Particularly, an LSTM auto-encoder is introduced for automatic feature engineering from sequential activities. To improve detection, a residual hybrid network (ResHybnet) containing GNN and CNN components is also proposed along with an organizational graph, taking a user-day combination as a node. Experimental results show that the proposed LSTM auto-encoder could extract hidden patterns from sequential activities efficiently, improving F1 score by 0.56%. Additionally, with the designed residual link, our ResHybnet model works well to boost performance and has outperformed the best of other models by 1.97% on the same features. We published our code on GitHub: https://github.com/Wayne-on-the-road/ResHybnet.