There are two broad objectives of the research reported in this paper. First, we assess whether government-provided cyber threat intelligence (CTI) is helpful in preventing, or responding to, cyber-attacks among small...There are two broad objectives of the research reported in this paper. First, we assess whether government-provided cyber threat intelligence (CTI) is helpful in preventing, or responding to, cyber-attacks among small businesses within the U.S. Defense Industrial Base (DIB). Second, we identify ways of improving the effectiveness of government-provided CTI to small businesses within the DIB. Based on a questionnaire-based survey, our findings suggest that government-provided CTI helps businesses within the DIB in preventing, or responding to, cyber-attacks providing a firm is familiar with the CTI. Unfortunately, a large percentage of small firms are not familiar with the government-provided CTI feeds and consequently are not utilizing the CTI. This latter situation is largely due to financial constraints confronting small businesses that prevent firms from having the wherewithal necessary to effectively utilize the government-provided CTI. However, we found a significant positive association between a firm’s familiarity with the government-provided CTI and whether a firm is being periodically reviewed by the Defense Counterintelligence and Security Agency (DCSA) or is compliant with the Cybersecurity Maturity Model Certification (CMMC) program. The findings from our study also show that the participating firms believe that external cyber threats are more likely to be the cause of a future cybersecurity breach than internal cybersecurity threats. Finally, our study found that the portion of the IT budget that small businesses within the DIB spend on cybersecurity-related activities is dependent on the perception that a firm would be the target of an external cyber-attack.展开更多
The continuous improvement of the cyber threat intelligence sharing mechanism provides new ideas to deal with Advanced Persistent Threats(APT).Extracting attack behaviors,i.e.,Tactics,Techniques,Procedures(TTP)from Cy...The continuous improvement of the cyber threat intelligence sharing mechanism provides new ideas to deal with Advanced Persistent Threats(APT).Extracting attack behaviors,i.e.,Tactics,Techniques,Procedures(TTP)from Cyber Threat Intelligence(CTI)can facilitate APT actors’profiling for an immediate response.However,it is difficult for traditional manual methods to analyze attack behaviors from cyber threat intelligence due to its heterogeneous nature.Based on the Adversarial Tactics,Techniques and Common Knowledge(ATT&CK)of threat behavior description,this paper proposes a threat behavioral knowledge extraction framework that integrates Heterogeneous Text Network(HTN)and Graph Convolutional Network(GCN)to solve this issue.It leverages the hierarchical correlation relationships of attack techniques and tactics in the ATT&CK to construct a text network of heterogeneous cyber threat intelligence.With the help of the Bidirectional EncoderRepresentation fromTransformers(BERT)pretraining model to analyze the contextual semantics of cyber threat intelligence,the task of threat behavior identification is transformed into a text classification task,which automatically extracts attack behavior in CTI,then identifies the malware and advanced threat actors.The experimental results show that F1 achieve 94.86%and 92.15%for the multi-label classification tasks of tactics and techniques.Extend the experiment to verify the method’s effectiveness in identifying the malware and threat actors in APT attacks.The F1 for malware and advanced threat actors identification task reached 98.45%and 99.48%,which are better than the benchmark model in the experiment and achieve state of the art.The model can effectivelymodel threat intelligence text data and acquire knowledge and experience migration by correlating implied features with a priori knowledge to compensate for insufficient sample data and improve the classification performance and recognition ability of threat behavior in text.展开更多
目的:观察威高(WEGO)植体后使用Bio-oss骨粉及CTi-mem钛网在口腔种植术中引导骨再生手术(Guided bone regeneration,GBR)的效果。方法:选择2014年1月-2019年1月在笔者医院接受WEGO植体种植修复、缺牙区域牙槽骨高度或宽度不足需GBR的单...目的:观察威高(WEGO)植体后使用Bio-oss骨粉及CTi-mem钛网在口腔种植术中引导骨再生手术(Guided bone regeneration,GBR)的效果。方法:选择2014年1月-2019年1月在笔者医院接受WEGO植体种植修复、缺牙区域牙槽骨高度或宽度不足需GBR的单颗后牙缺损患者,按所使用的生物屏障膜分组。其中94例使用的生物屏障膜为Bio-oss骨粉及CTi-mem钛网,患者纳入观察组;71例使用Bio-oss骨粉及海奥生物膜进行GBR的患者纳入对照组。统计两组GBR及种植期间有无钛网暴露、软组织裂开现象等不良事件,并于术后7d评价两组术区黏膜颜色分级、黏膜肿胀度及黏膜出血指数,6个月后评价骨再生效果。结果:两组均顺利完成GBR及同期种植,不良事件发生率、术后7d时术区黏膜颜色、黏膜肿胀度、黏膜出血指数及植骨厚度比较差异无统计学意义(P>0.05);但观察组成骨厚度及骨再生效果显著高于对照组,差异有统计学意义(P<0.05);两组患者均顺利开展二期修复,未见不良反应,有效成骨并有正常负载,咬合功能良好。结论:WEGO植体后使用Bio-oss骨粉及CTi-mem钛网引导骨再生,在不良事件发生率、术区黏膜状态上与使用Bio-oss骨粉及海奥生物膜虽无显著性差异,但前者引导骨再生效果更佳。展开更多
文摘There are two broad objectives of the research reported in this paper. First, we assess whether government-provided cyber threat intelligence (CTI) is helpful in preventing, or responding to, cyber-attacks among small businesses within the U.S. Defense Industrial Base (DIB). Second, we identify ways of improving the effectiveness of government-provided CTI to small businesses within the DIB. Based on a questionnaire-based survey, our findings suggest that government-provided CTI helps businesses within the DIB in preventing, or responding to, cyber-attacks providing a firm is familiar with the CTI. Unfortunately, a large percentage of small firms are not familiar with the government-provided CTI feeds and consequently are not utilizing the CTI. This latter situation is largely due to financial constraints confronting small businesses that prevent firms from having the wherewithal necessary to effectively utilize the government-provided CTI. However, we found a significant positive association between a firm’s familiarity with the government-provided CTI and whether a firm is being periodically reviewed by the Defense Counterintelligence and Security Agency (DCSA) or is compliant with the Cybersecurity Maturity Model Certification (CMMC) program. The findings from our study also show that the participating firms believe that external cyber threats are more likely to be the cause of a future cybersecurity breach than internal cybersecurity threats. Finally, our study found that the portion of the IT budget that small businesses within the DIB spend on cybersecurity-related activities is dependent on the perception that a firm would be the target of an external cyber-attack.
基金supported by China’s National Key R&D Program,No.2019QY1404the National Natural Science Foundation of China,Grant No.U20A20161,U1836103the Basic Strengthening Program Project,No.2019-JCJQ-ZD-113.
文摘The continuous improvement of the cyber threat intelligence sharing mechanism provides new ideas to deal with Advanced Persistent Threats(APT).Extracting attack behaviors,i.e.,Tactics,Techniques,Procedures(TTP)from Cyber Threat Intelligence(CTI)can facilitate APT actors’profiling for an immediate response.However,it is difficult for traditional manual methods to analyze attack behaviors from cyber threat intelligence due to its heterogeneous nature.Based on the Adversarial Tactics,Techniques and Common Knowledge(ATT&CK)of threat behavior description,this paper proposes a threat behavioral knowledge extraction framework that integrates Heterogeneous Text Network(HTN)and Graph Convolutional Network(GCN)to solve this issue.It leverages the hierarchical correlation relationships of attack techniques and tactics in the ATT&CK to construct a text network of heterogeneous cyber threat intelligence.With the help of the Bidirectional EncoderRepresentation fromTransformers(BERT)pretraining model to analyze the contextual semantics of cyber threat intelligence,the task of threat behavior identification is transformed into a text classification task,which automatically extracts attack behavior in CTI,then identifies the malware and advanced threat actors.The experimental results show that F1 achieve 94.86%and 92.15%for the multi-label classification tasks of tactics and techniques.Extend the experiment to verify the method’s effectiveness in identifying the malware and threat actors in APT attacks.The F1 for malware and advanced threat actors identification task reached 98.45%and 99.48%,which are better than the benchmark model in the experiment and achieve state of the art.The model can effectivelymodel threat intelligence text data and acquire knowledge and experience migration by correlating implied features with a priori knowledge to compensate for insufficient sample data and improve the classification performance and recognition ability of threat behavior in text.
文摘目的:观察威高(WEGO)植体后使用Bio-oss骨粉及CTi-mem钛网在口腔种植术中引导骨再生手术(Guided bone regeneration,GBR)的效果。方法:选择2014年1月-2019年1月在笔者医院接受WEGO植体种植修复、缺牙区域牙槽骨高度或宽度不足需GBR的单颗后牙缺损患者,按所使用的生物屏障膜分组。其中94例使用的生物屏障膜为Bio-oss骨粉及CTi-mem钛网,患者纳入观察组;71例使用Bio-oss骨粉及海奥生物膜进行GBR的患者纳入对照组。统计两组GBR及种植期间有无钛网暴露、软组织裂开现象等不良事件,并于术后7d评价两组术区黏膜颜色分级、黏膜肿胀度及黏膜出血指数,6个月后评价骨再生效果。结果:两组均顺利完成GBR及同期种植,不良事件发生率、术后7d时术区黏膜颜色、黏膜肿胀度、黏膜出血指数及植骨厚度比较差异无统计学意义(P>0.05);但观察组成骨厚度及骨再生效果显著高于对照组,差异有统计学意义(P<0.05);两组患者均顺利开展二期修复,未见不良反应,有效成骨并有正常负载,咬合功能良好。结论:WEGO植体后使用Bio-oss骨粉及CTi-mem钛网引导骨再生,在不良事件发生率、术区黏膜状态上与使用Bio-oss骨粉及海奥生物膜虽无显著性差异,但前者引导骨再生效果更佳。
