AspIOC: Aspect-Enhanced Deep Neural Network for Actionable Indicator of Compromise Recognition

Shaofeng Wang; Bo Lang; Nan Xiao; Yikai Chen

doi:10.1007/978-3-031-22390-7_24

AspIOC: Aspect-Enhanced Deep Neural Network for Actionable Indicator of Compromise Recognition

Shaofeng Wang
, Bo Lang^*
, Nan Xiao
, Yikai Chen

^*Corresponding author for this work

School of Computer Science and Engineering

Beihang University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

2 Scopus citations

Abstract

A crucial component of unstructured threat information is the Indicator of Compromise (IOC), which includes malicious IP addresses and domain names. Because non-malicious IP addresses and domain names exist in the threat intelligence texts, the extracted IOCs are often blended with benign entities. Therefore, the current IOC extraction methods are limited in accuracy when determining whether an entity is malicious. In this paper, the problem of IOC recognition is defined as the issue of aspect-level text polarity classification and an aspect-enhanced deep network model for IOC recognition (AspIOC) is presented. While proposing a pre-training model, the network combines IOC contextual characteristics with IOC character features. We collect about 100,000 samples and construct a dataset using an open-source web platform. The experimental results demonstrate that the accuracy and F1 of the proposed IOC discovery method are 99.92%. Our model is better than the most advanced methods currently in use and satisfies industry standards for IOC recognition.

Original language	English
Title of host publication	Information Security - 25th International Conference, ISC 2022, Proceedings
Editors	Willy Susilo, Fuchun Guo, Yudi Zhang, Xiaofeng Chen, Rolly Intan
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	411-421
Number of pages	11
ISBN (Print)	9783031223891
DOIs	https://doi.org/10.1007/978-3-031-22390-7_24
State	Published - 2022
Event	25th Information Security Conference, ISC 2022 - Hybrid, Bali, Indonesia Duration: 18 Dec 2022 → 22 Dec 2022

Publication series

Name	Lecture Notes in Computer Science
Volume	13640 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	25th Information Security Conference, ISC 2022
Country/Territory	Indonesia
City	Hybrid, Bali
Period	18/12/22 → 22/12/22

Keywords

Aspect-level text polarity classification
Deep neural network
Indicator of compromise

Access to Document

10.1007/978-3-031-22390-7_24

Cite this

Wang, S., Lang, B., Xiao, N., & Chen, Y. (2022). AspIOC: Aspect-Enhanced Deep Neural Network for Actionable Indicator of Compromise Recognition. In W. Susilo, F. Guo, Y. Zhang, X. Chen, & R. Intan (Eds.), Information Security - 25th International Conference, ISC 2022, Proceedings (pp. 411-421). (Lecture Notes in Computer Science; Vol. 13640 LNCS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-031-22390-7_24

Wang, Shaofeng ; Lang, Bo ; Xiao, Nan et al. / AspIOC : Aspect-Enhanced Deep Neural Network for Actionable Indicator of Compromise Recognition. Information Security - 25th International Conference, ISC 2022, Proceedings. editor / Willy Susilo ; Fuchun Guo ; Yudi Zhang ; Xiaofeng Chen ; Rolly Intan. Springer Science and Business Media Deutschland GmbH, 2022. pp. 411-421 (Lecture Notes in Computer Science).

@inproceedings{c46c74e666d945ceabd7b2d29da224e7,

title = "AspIOC: Aspect-Enhanced Deep Neural Network for Actionable Indicator of Compromise Recognition",

abstract = "A crucial component of unstructured threat information is the Indicator of Compromise (IOC), which includes malicious IP addresses and domain names. Because non-malicious IP addresses and domain names exist in the threat intelligence texts, the extracted IOCs are often blended with benign entities. Therefore, the current IOC extraction methods are limited in accuracy when determining whether an entity is malicious. In this paper, the problem of IOC recognition is defined as the issue of aspect-level text polarity classification and an aspect-enhanced deep network model for IOC recognition (AspIOC) is presented. While proposing a pre-training model, the network combines IOC contextual characteristics with IOC character features. We collect about 100,000 samples and construct a dataset using an open-source web platform. The experimental results demonstrate that the accuracy and F1 of the proposed IOC discovery method are 99.92\%. Our model is better than the most advanced methods currently in use and satisfies industry standards for IOC recognition.",

keywords = "Aspect-level text polarity classification, Deep neural network, Indicator of compromise",

author = "Shaofeng Wang and Bo Lang and Nan Xiao and Yikai Chen",

note = "Publisher Copyright: {\textcopyright} 2022, The Author(s), under exclusive license to Springer Nature Switzerland AG.; 25th Information Security Conference, ISC 2022 ; Conference date: 18-12-2022 Through 22-12-2022",

year = "2022",

doi = "10.1007/978-3-031-22390-7\_24",

language = "英语",

isbn = "9783031223891",

series = "Lecture Notes in Computer Science",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "411--421",

editor = "Willy Susilo and Fuchun Guo and Yudi Zhang and Xiaofeng Chen and Rolly Intan",

booktitle = "Information Security - 25th International Conference, ISC 2022, Proceedings",

address = "德国",

}

Wang, S, Lang, B, Xiao, N & Chen, Y 2022, AspIOC: Aspect-Enhanced Deep Neural Network for Actionable Indicator of Compromise Recognition. in W Susilo, F Guo, Y Zhang, X Chen & R Intan (eds), Information Security - 25th International Conference, ISC 2022, Proceedings. Lecture Notes in Computer Science, vol. 13640 LNCS, Springer Science and Business Media Deutschland GmbH, pp. 411-421, 25th Information Security Conference, ISC 2022, Hybrid, Bali, Indonesia, 18/12/22. https://doi.org/10.1007/978-3-031-22390-7_24

AspIOC: Aspect-Enhanced Deep Neural Network for Actionable Indicator of Compromise Recognition. / Wang, Shaofeng; Lang, Bo; Xiao, Nan et al.
Information Security - 25th International Conference, ISC 2022, Proceedings. ed. / Willy Susilo; Fuchun Guo; Yudi Zhang; Xiaofeng Chen; Rolly Intan. Springer Science and Business Media Deutschland GmbH, 2022. p. 411-421 (Lecture Notes in Computer Science; Vol. 13640 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - AspIOC

T2 - 25th Information Security Conference, ISC 2022

AU - Wang, Shaofeng

AU - Lang, Bo

AU - Xiao, Nan

AU - Chen, Yikai

PY - 2022

Y1 - 2022

N2 - A crucial component of unstructured threat information is the Indicator of Compromise (IOC), which includes malicious IP addresses and domain names. Because non-malicious IP addresses and domain names exist in the threat intelligence texts, the extracted IOCs are often blended with benign entities. Therefore, the current IOC extraction methods are limited in accuracy when determining whether an entity is malicious. In this paper, the problem of IOC recognition is defined as the issue of aspect-level text polarity classification and an aspect-enhanced deep network model for IOC recognition (AspIOC) is presented. While proposing a pre-training model, the network combines IOC contextual characteristics with IOC character features. We collect about 100,000 samples and construct a dataset using an open-source web platform. The experimental results demonstrate that the accuracy and F1 of the proposed IOC discovery method are 99.92%. Our model is better than the most advanced methods currently in use and satisfies industry standards for IOC recognition.

AB - A crucial component of unstructured threat information is the Indicator of Compromise (IOC), which includes malicious IP addresses and domain names. Because non-malicious IP addresses and domain names exist in the threat intelligence texts, the extracted IOCs are often blended with benign entities. Therefore, the current IOC extraction methods are limited in accuracy when determining whether an entity is malicious. In this paper, the problem of IOC recognition is defined as the issue of aspect-level text polarity classification and an aspect-enhanced deep network model for IOC recognition (AspIOC) is presented. While proposing a pre-training model, the network combines IOC contextual characteristics with IOC character features. We collect about 100,000 samples and construct a dataset using an open-source web platform. The experimental results demonstrate that the accuracy and F1 of the proposed IOC discovery method are 99.92%. Our model is better than the most advanced methods currently in use and satisfies industry standards for IOC recognition.

KW - Aspect-level text polarity classification

KW - Deep neural network

KW - Indicator of compromise

UR - https://www.scopus.com/pages/publications/85145265231

U2 - 10.1007/978-3-031-22390-7_24

DO - 10.1007/978-3-031-22390-7_24

M3 - 会议稿件

AN - SCOPUS:85145265231

SN - 9783031223891

T3 - Lecture Notes in Computer Science

SP - 411

EP - 421

BT - Information Security - 25th International Conference, ISC 2022, Proceedings

A2 - Susilo, Willy

A2 - Guo, Fuchun

A2 - Zhang, Yudi

A2 - Chen, Xiaofeng

A2 - Intan, Rolly

PB - Springer Science and Business Media Deutschland GmbH

Y2 - 18 December 2022 through 22 December 2022

ER -

Wang S, Lang B, Xiao N, Chen Y. AspIOC: Aspect-Enhanced Deep Neural Network for Actionable Indicator of Compromise Recognition. In Susilo W, Guo F, Zhang Y, Chen X, Intan R, editors, Information Security - 25th International Conference, ISC 2022, Proceedings. Springer Science and Business Media Deutschland GmbH. 2022. p. 411-421. (Lecture Notes in Computer Science). doi: 10.1007/978-3-031-22390-7_24