MDATA Model Based Cyber Security Knowledge Representation and Application

Cyberspace security has become more and more complicated with the rapidly evolving attack and defense technologies. As attackers prefer to execute attacks through multiple sequential steps and use different hosts to hide themselves, traditional methods fail to detect the attacks by correlating multi-source information. In this paper, we propose to represent cyber security knowledge efficiently and to detect attacks with the help of the knowledge. Since network attacks are highly related to temporal and spatial characteristics, we adopt the MDATA model to represent the cyber security knowledge instead of the classical knowledge graph. Specifically, we convert multi-step attack rules into the MDATA graph, which are defined based on professional frameworks such as ATT&CK and Cyber Kill Chain models. Based on the MDATA graph, we abstract the stream of security alerts as basic attack nodes and adopt subgraph matching to detect the complicated attacks which contain multiple steps. The proposed method can have good generalization ability and better interpretability compared with traditional attack detection methods.