Automatically predicting cyber attack preference with attributed heterogeneous attention networks and transductive learning

Predicting cyber attack preference of intruders is essential for security organizations to demystify attack intents and proactively handle oncoming cyber threats. In order to automatically analyze attack preferences of intruders, this paper proposes a novel framework, namely HinAp, to predict cyber attack preference using attributed heterogeneous attention network and transductive learning. Particularly, we first build an attributed heterogeneous information network (AHIN) of attack events to model attackers, vulnerabilities, exploited scripts, compromised devices, invaded platforms, and 20 types of meta-paths describing interdependent relationships among them, in which attribute information of vulnerabilities and exploited scripts are embedded. Then, we propose the attack preference prediction model based on attention mechanism and transductive learning, respectively. Finally, an automated model for predicting cyber attack preferences is constructed by stacking these two basic prediction models, which capable of integrating more comprehensive and complex semantic information from meta-paths and meta-graphs to characterize attack preference of intruders. Experimental results based on real-world data prove that HinAp outperforms the state-of-the-art methods in predicting cyber attack preferences of intruders.