论文标题
将威胁策略，技术和模式与防御弱点，脆弱性和影响网络狩猎的平台配置联系起来
Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting
论文作者
论文摘要
存在许多网络威胁和脆弱性信息的公共来源，以帮助捍卫网络系统。本文链接了Miter的ATT＆CK策略和技术矩阵，NIST的共同弱点枚举（CWE），共同的漏洞和暴露（CVE）以及共同的攻击模式枚举和分类列表（CAPEC），从警报，威胁和漏洞中获得进一步的见解。我们保留了来源的所有条目和关系，同时启用了称为Bron的聚合数据图内的双向关系路径跟踪。在一个示例中，我们使用bron来增强从前十大最常见的CVE的列表中得出的信息。我们确定利用这些CVE的攻击模式，策略和技术，并发现了这些CVE中每个CVE的链接信息的差异。这促使我们进一步库存Bron的来源集合，以提供公共数据源的覆盖范围和盲点的程度和范围。
Many public sources of cyber threat and vulnerability information exist to help defend cyber systems. This paper links MITRE's ATT&CK MATRIX of Tactics and Techniques, NIST's Common Weakness Enumerations (CWE), Common Vulnerabilities and Exposures (CVE), and Common Attack Pattern Enumeration and Classification list (CAPEC), to gain further insight from alerts, threats and vulnerabilities. We preserve all entries and relations of the sources, while enabling bi-directional, relational path tracing within an aggregate data graph called BRON. In one example, we use BRON to enhance the information derived from a list of the top 10 most frequently exploited CVEs. We identify attack patterns, tactics, and techniques that exploit these CVEs and also uncover a disparity in how much linked information exists for each of these CVEs. This prompts us to further inventory BRON's collection of sources to provide a view of the extent and range of the coverage and blind spots of public data sources.
