Black hat hackers use malicious exploits to circumvent security controls and take advantage of system vulnerabilities worldwide, costing the global economy over $450 billion annually. While many organizations are increasingly turning to cyber threat intelligence (CTI) to help prioritize their vulnerabilities, extant CTI processes are often criticized as being reactive to known exploits. One promising data source that can help develop proactive CTI is the vast and ever-evolving Dark Web. In this study, we adopted the computational design science paradigm to design a novel deep learning (DL)-based exploit-vulnerability attention deep structured semantic model (EVA-DSSM) that includes bidirectional processing and attention mechanisms to automatically link exploits from the Dark Web to vulnerabilities. We also devised a novel device vulnerability severity metric (DVSM) that incorporates the exploit post date and vulnerability severity to help cybersecurity professionals with their device prioritization and risk management efforts. We rigorously evaluated the EVA-DSSM against state-of-the-art non-DL and DL-based methods for short text matching on 52,590 exploit-vulnerability linkages across four testbeds: web application, remote, local, and denial of service. Results of these evaluations indicate that the proposed EVA-DSSM achieves precision at 1 scores 20% - 41% higher than non-DL approaches and 4% - 10% higher than DL-based approaches. We demonstrated the EVA-DSSM’s and DVSM’s practical utility with two CTI case studies: openly accessible systems in the top eight U.S. hospitals and over 20,000 Supervisory Control and Data Acquisition (SCADA) systems worldwide. A complementary user evaluation of the case study results indicated that 45 cybersecurity professionals found the EVA-DSSM and DVSM results more useful for exploit-vulnerability linking and risk prioritization activities than those produced by prevailing approaches. Given the rising cost of cyberattacks, the EVA-DSSM and DVSM have important implications for analysts in security operations centers, incident response teams, and cybersecurity vendors.
Linking Exploits from the Dark Web to Known Vulnerabilities for Proactive Cyber Threat Intelligence: An Attention-based Deep Structured Semantic Model1 Available to Purchase
Sagar Samtani is an assistant professor and Grant Thornton Scholar in the Department of Operations and Decision Technologies at the Kelley School of Business at Indiana University. Samtani graduated with his Ph.D. in management information systems from the University of Arizona’s Artificial Intelligence (AI) Lab, where he served as a CyberCorps Scholarship-for-Service Fellow. Samtani’s AI for cybersecurity and Dark Web analytics research initiatives have received funding from the National Science Foundation CRII, CICI, SaTC-EDU, and SFS programs. Samtani has published over 40 peer-reviewed articles in journals and conference proceedings, including MIS Quarterly, Journal of MIS, IEEE Intelligent Systems, ACM Transactions on Privacy and Security, IEEE S&P, IEEE ICDM, IEEE ISI, and others. He is currently an associate editor at ACM Transactions on MIS, ACM Digital Threats: Research and Practice, and Information and Management and has served as a guest editor at IEEE Transactions on Dependable and Secure Computing and ACM Transactions on MIS. His research has received multiple awards and significant media coverage and citations from outlets such as the Miami Herald, Fox News, and Science. Dr. Samtani was inducted into the NSF/CISA CyberCorps SFS Hall of Fame in 2022 for his contributions to the cybersecurity community. He is a member of the IEEE, ACM, AIS, and INFORMS.
Yidong Chai is a professor at the School of Management at the Hefei University of Technology. He received his Ph.D. degree from the Department of Management Science and Engineering of Tsinghua University. His research centers around machine learning for health informatics, cyber threat intelligence, and business intelligence. His work has appeared in journals including MIS Quarterly, Information Processing and Management, Knowledge-Based Systems and Applied Soft Computing, as well as conferences and workshops including IEEE S&P, INFORMS Workshop on Data Science, Workshop on Information Technology Systems, International Conference on Smart Health, and International Conference on Information Systems.
Hsinchun Chen is Regents Professor and Thomas R. Brown Chair in Management and Technology in the Management Information Systems Department at the Eller College of Management, University of Arizona. He received his Ph.D. in Information Systems from New York University. He is the author/editor of 20 books, 300 SCI journal articles, and 200 refereed conference articles covering digital library, data/text/web mining, business analytics, security informatics, and health informatics. He founded the Artificial Intelligence Lab at The University of Arizona in 1989, which has received $50M+ research funding from the NSF, National Institutes of Health, National Library of Medicine, Department of Defense, Department of Justice, Central Intelligence Agency, Department of Homeland Security, and other agencies (100+ grants, 50+ from NSF). He has served as editor-in-chief, senior editor or AE of major ACM/IEEE (ACM TMIS, ACM TOIS, IEEE IS, IEEE SMC), MIS (MISQ, DSS) and Springer (JASIST) journals and conference/program chair of major ACM/IEEE/MIS conferences in digital library (ACM/IEEE JCDL, ICADL), information systems (ICIS), security informatics (IEEE ISI), and health informatics (ICSH). His COPLINK/i2 system for security analytics was commercialized in 2000 and acquired by IBM as its leading government analytics product in 2011. The COPLINK/i2 system is used in 5,000+ law enforcement jurisdictions and intelligence agencies in the U.S. and Europe, making a significant contribution to public safety worldwide. Dr. Chen is director of the UA AZSecure Cybersecurity Program, with $10M+ funding from NSF SFS, SaTC, and CICI programs and CAE-CD/CAE-R cybersecurity designations from NSA/DHS. He is a fellow of ACM, IEEE, and AAAS.
Sagar Samtani, Yidong Chai, Hsinchun Chen; Linking Exploits from the Dark Web to Known Vulnerabilities for Proactive Cyber Threat Intelligence: An Attention-based Deep Structured Semantic Model1. MIS Quarterly 1 June 2022; 46 (2): 911–946. https://doi.org/10.25300/MISQ/2022/15392
Download citation file:
