CREATING PROACTIVE CYBER THREAT INTELLIGENCE WITH HACKER EXPLOIT LABELS : A DEEP TRANSFER LEARNING APPROACH

• 成果类型: Article
• 署名作者: Ampel, Benjamin M.; Samtani, Sagar; Zhu, Hongyi; Chen, Hsinchun
• 署名单位: University of Arizona; Indiana University System; Indiana University Bloomington; University of Texas System; University of Texas at San Antonio
• 刊物名称: MIS QUARTERLY
• ISSN/ISSBN: 0276-7783
• DOI: 10.25300/MISQ/2023/17316
• 发表日期: 2024
• 页码: 137-166
• 关键词: design-science; CLASSIFICATION; identification; analytics; IMPACT; lstm

摘要

The rapid proliferation of complex information systems has been met by an ever-increasing quantity of exploits that can cause irreparable cyber breaches. To mitigate these cyber threats, academia and industry have placed a significant focus on proactively identifying and labeling exploits developed by the international hacker community. However, prevailing approaches for labeling exploits in hacker forums do not leverage metadata from exploit darknet markets or public exploit repositories to enhance labeling performance. In this study, we adopted the computational design science paradigm to develop a novel information technology artifact, the deep transfer learning exploit labeler (DTL-EL). DTL-EL incorporates a pre -initialization design, multi -layer deep transfer learning (DTL), and a self -attention mechanism to automatically label exploits in hacker forums. We rigorously evaluated the proposed DTLEL against state-of-the-art non-DTL benchmark methods based in classical machine learning and deep learning. Results suggest that the proposed DTL-EL significantly outperforms benchmark methods based on accuracy, precision, recall, and F1 -score. Our proposed DTL-EL framework provides important practical implications for key stakeholders such as cybersecurity managers, analysts, and educators.