Matching Knowledge Graphs for Cybersecurity Countermeasures Selection
Résumé
As cyberattacks continue to increase, detecting and performing
remediation actions against them is essential. This paper presents an
approach to automate the countermeasures selection process to deal with
a vulnerability exploitation performed by a cyberattack. We propose an
approach to match two knowledge graphs, one from a vulnerability ontology,
Vulnerability Description Ontology (VDO), and the other is the
countermeasures knowledge graph, D3FEND, to mitigate cyberattack
impacts. Our approach uses machine learning and an inference system
to match entities from VDO and D3FEND to select candidate countermeasures
to an attack. Our contribution aims to automatically select
countermeasures intended to be part of an incident response playbook
for a vulnerability. We show our approach application to a WannaCry
use-case scenario.We validate our countermeasures selection approach by
comparing the countermeasures automatically selected with those proposed
in the literature for a WannaCry attack.
Origine | Fichiers produits par l'(les) auteur(s) |
---|