Abstract: Threat analysis is continuously growing in importance due to the always-increasing complexity and frequency of cyber attacks. Analyzing threats demands significant effort from security experts, leading to delays in the security analysis process. Different cybersecurity knowledge bases are currently available to support this task, but manual efforts are often required to correlate such heterogeneous sources into a unified view that would enable a more comprehensive assessment. To address this gap, we propose ThreatLinker, a methodology leveraging Natural Language Processing (NLP) to effectively and efficiently associate Common Vulnerabilities and Exposure (CVE) vulnerabilities with Common Attack Pattern Enumeration and Classification (CAPEC) attack patterns. The proposed technique combines semantic similarity with keyword analysis to improve the accuracy of association estimations. Experimental evaluations demonstrate superior performance compared to state-of-the-art models, reducing manual effort and analysis time, and enabling cybersecurity professionals to prioritize critical tasks.
Threatlinker is a Django-based project aimed at correlating Common Vulnerabilities and Exposures (CVE) with Common Attack Pattern Enumeration and Classification (CAPEC) attack patterns. This project seeks to streamline the process of identifying relationships between known vulnerabilities and attack patterns, enhancing threat intelligence analysis for cybersecurity professionals.
CUDA (Compute Unified Device Architecture) is a parallel computing platform and programming model created by NVIDIA. It allows PyTorch to perform computations on NVIDIA GPUs, significantly speeding up tasks such as training and inference for deep learning models.
If you have an NVIDIA GPU and CUDA installed on your machine, you can enable PyTorch to utilize GPU acceleration by installing a CUDA-compatible version of torch.
Note: CUDA is only compatible with NVIDIA GPUs. If you don’t have an NVIDIA GPU, you can skip this step and install the default CPU-only version of PyTorch.
To check your CUDA version, run:
nvcc --version
Once you know your CUDA version, install PyTorch with CUDA support using the following command:
# Replace `cu118` with your specific CUDA version, e.g., cu117 for CUDA 11.7, cu116 for CUDA 11.6, etc.
pip install torch --index-url https://download.pytorch.org/whl/cu118
For more details on PyTorch installation options, visit the official PyTorch installation page.
The project is structured as follows:
Django Framework: Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It handles much of the complexity in web development, providing built-in tools for database management, form handling, authentication, and more. In this project, Django is the backbone that integrates and serves data, manages URL routing, and enables interaction between the different modules related to CVE, CWE, and CAPEC data.
PostgreSQL: PostgreSQL is a powerful, open-source object-relational database system that is used as the primary database for storing CVE, CWE, and CAPEC data in Threatlinker. It provides advanced indexing, data integrity, and supports JSON fields, making it an ideal choice for efficiently handling the complex relationships and structured data this project requires.
Memurai or Redis: Memurai (for Windows) or Redis (for Linux) serves as the message broker and task queue backend for Celery in this project. It handles asynchronous tasks, allowing us to process data updates, such as importing and updating CVE, CWE, and CAPEC records, without blocking the main application’s performance. This is essential for managing the background tasks required by the application, ensuring smooth and efficient data processing.
Virtual Environment: A Python virtual environment is set up to manage dependencies and maintain isolation from other projects, ensuring compatibility across different setups.
Git Integration: The project is managed using Git and hosted on GitHub for version control, allowing for collaborative development, tracking changes, and maintaining code history.
The Threatlinker project is organized into four main applications, each with specific roles:
Set up the PostgreSQL database:
postgres user:
psql -U postgres
DROP DATABASE IF EXISTS threatlinker_db;
DROP USER IF EXISTS threatlinker_user;
CREATE DATABASE threatlinker_db;
CREATE USER threatlinker_user WITH PASSWORD 'threatlinkerpwd';
GRANT ALL PRIVILEGES ON DATABASE threatlinker_db TO threatlinker_user;
\q
Clone the repository:
git clone https://github.com/andreaciavotta/threatlinker.git
cd threatlinker
Create a virtual environment and activate it:
Windows:
python -m venv .venv
.venv\Scripts\activate
Linux/macOS:
python3 -m venv .venv
source .venv/bin/activate
Install required dependencies (on Windows):
install_windows.bat
Please look at the CUDA dependencies if you have nVidia. If needed first use:
pip cache purge
Run migrations:
python manage.py migrate
Create an admin (superuser) account: To access the Django admin interface, you need to create a superuser. Run:
python manage.py createsuperuser
Follow the prompts to set up a username, email, and password for the superuser.
Start the development server with parallel processes:
python run_windows.py
(For Linux, a similar script can be created to streamline startup.)
Once the server is running, navigate to http://127.0.0.1:8000 in your browser to access the application.
To contribute to this project:
Abstract: Threat analysis is continuously growing in importance due to the always-increasing complexity and frequency of cyber attacks. Analyzing threats demands significant effort from security experts, leading to delays in the security analysis process. Different cybersecurity knowledge bases are currently available to support this task, but manual efforts are often required to correlate such heterogeneous sources into a unified view that would enable a more comprehensive assessment. To address this gap, we propose ThreatLinker, a methodology leveraging Natural Language Processing (NLP) to effectively and efficiently associate Common Vulnerabilities and Exposure (CVE) vulnerabilities with Common Attack Pattern Enumeration and Classification (CAPEC) attack patterns. The proposed technique combines semantic similarity with keyword analysis to improve the accuracy of association estimations. Experimental evaluations demonstrate superior performance compared to state-of-the-art models, reducing manual effort and analysis time, and enabling cybersecurity professionals to prioritize critical tasks.
Threatlinker is a Django-based project aimed at correlating Common Vulnerabilities and Exposures (CVE) with Common Attack Pattern Enumeration and Classification (CAPEC) attack patterns. This project seeks to streamline the process of identifying relationships between known vulnerabilities and attack patterns, enhancing threat intelligence analysis for cybersecurity professionals.
CUDA (Compute Unified Device Architecture) is a parallel computing platform and programming model created by NVIDIA. It allows PyTorch to perform computations on NVIDIA GPUs, significantly speeding up tasks such as training and inference for deep learning models.
If you have an NVIDIA GPU and CUDA installed on your machine, you can enable PyTorch to utilize GPU acceleration by installing a CUDA-compatible version of torch.
Note: CUDA is only compatible with NVIDIA GPUs. If you don’t have an NVIDIA GPU, you can skip this step and install the default CPU-only version of PyTorch.
To check your CUDA version, run:
nvcc --version
Once you know your CUDA version, install PyTorch with CUDA support using the following command:
# Replace `cu118` with your specific CUDA version, e.g., cu117 for CUDA 11.7, cu116 for CUDA 11.6, etc.
pip install torch --index-url https://download.pytorch.org/whl/cu118
For more details on PyTorch installation options, visit the official PyTorch installation page.
The project is structured as follows:
Django Framework: Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It handles much of the complexity in web development, providing built-in tools for database management, form handling, authentication, and more. In this project, Django is the backbone that integrates and serves data, manages URL routing, and enables interaction between the different modules related to CVE, CWE, and CAPEC data.
PostgreSQL: PostgreSQL is a powerful, open-source object-relational database system that is used as the primary database for storing CVE, CWE, and CAPEC data in Threatlinker. It provides advanced indexing, data integrity, and supports JSON fields, making it an ideal choice for efficiently handling the complex relationships and structured data this project requires.
Memurai or Redis: Memurai (for Windows) or Redis (for Linux) serves as the message broker and task queue backend for Celery in this project. It handles asynchronous tasks, allowing us to process data updates, such as importing and updating CVE, CWE, and CAPEC records, without blocking the main application’s performance. This is essential for managing the background tasks required by the application, ensuring smooth and efficient data processing.
Virtual Environment: A Python virtual environment is set up to manage dependencies and maintain isolation from other projects, ensuring compatibility across different setups.
Git Integration: The project is managed using Git and hosted on GitHub for version control, allowing for collaborative development, tracking changes, and maintaining code history.
The Threatlinker project is organized into four main applications, each with specific roles:
Set up the PostgreSQL database:
postgres user:
psql -U postgres
DROP DATABASE IF EXISTS threatlinker_db;
DROP USER IF EXISTS threatlinker_user;
CREATE DATABASE threatlinker_db;
CREATE USER threatlinker_user WITH PASSWORD 'threatlinkerpwd';
GRANT ALL PRIVILEGES ON DATABASE threatlinker_db TO threatlinker_user;
\q
Clone the repository:
git clone https://github.com/andreaciavotta/threatlinker.git
cd threatlinker
Create a virtual environment and activate it:
Windows:
python -m venv .venv
.venv\Scripts\activate
Linux/macOS:
python3 -m venv .venv
source .venv/bin/activate
Install required dependencies (on Windows):
install_windows.bat
Please look at the CUDA dependencies if you have nVidia. If needed first use:
pip cache purge
Run migrations:
python manage.py migrate
Create an admin (superuser) account: To access the Django admin interface, you need to create a superuser. Run:
python manage.py createsuperuser
Follow the prompts to set up a username, email, and password for the superuser.
Start the development server with parallel processes:
python run_windows.py
(For Linux, a similar script can be created to streamline startup.)
Once the server is running, navigate to http://127.0.0.1:8000 in your browser to access the application.
To contribute to this project: