System and method for classifying cyber security threats using natural language processing
A method and system for classification of cyber-threats is provided. The method includes receiving a request for classifying a cyber-threat detected by a cyber-security system, wherein the request includes initial information about the detected cyber-threat; enriching the initial information about the detected cyber-threat to provide textual information about at least one perceived threat related to the detected cyber-threat; and classifying each of the at least one perceived threat into a security service, wherein the classification is performed based on the respective textual information.
1. A method for classification of cyber-threats, comprising:
receiving a request for classifying a cyber-threat detected by a cyber-security system, wherein the request includes initial information about the detected cyber-threat;
querying a plurality of external resources to obtain textual information about at least one perceived threat related to the detected cyber-threat;
enriching the initial information with the obtained textual information to form textual threat information;
normalizing the textual threat information;
vectorizing the normalized textual threat information into a vector; and
classifying the at least one perceived threat by mapping the vector to at least one security engine.
2. The method of claim 1 , wherein enriching the initial information further comprises:
searching the external resources for cyber-threats similar to detected cyber-threat, wherein the search is performing using aliases matching a threat identifier of the detected cyber-threat; and
retrieving from at least one of the plurality of external resources additional information related to the at least one perceived threat, wherein each perceived threat includes any one of: the detected cyber-threat and a cyber-threat similar to the detected cyber-threat.
3. The method of claim 1 , wherein each external resource includes any information source maintained by any one of: cyber research organizations and cyber-security vendors.
4. The method of claim 1 , wherein features of the at least one perceived threat include at least any of: a file name and a hash value of the least one the at least one perceived threat.
5. The method of claim 4 , further comprising:
classifying each of the at least one perceived threat using one or more artificial intelligence techniques.
6. The method of claim 1 , wherein the security engine comprises at least one vector, each representing intent of the detected cyber-threat.
7. The method of claim 1 , further comprising:
determining an intent of each of the at least one perceived threat based on the classification.
8. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for classification of cyber-threats, comprising:
receiving a request for classifying a cyber-threat detected by a cyber-security system, wherein the request includes initial information about the detected cyber-threat;
querying a plurality of external resources to obtain textual information about at least one perceived threat related to the detected cyber-threat;
enriching the initial information with the obtained textual information to form textual threat information;
normalizing the textual threat information;
vectorizing the normalized textual threat information into a vector; and
classifying the at least one perceived threat by mapping the vector to a security function of at least one security engine or service.
9. A cyber-security system for classifying security rules of a plurality of different security products into a security decision engine in a service, comprising: a processing circuitry;
a memory connected to the processing circuitry, wherein the memory contains instructions that, when executed by the processing circuitry, configure the cyber-security system to:
receive a request for classifying a cyber-threat detected by a cyber-security system, wherein the request includes initial information about the detected cyber-threat;
query a plurality of external resources to obtain textual information about at least one perceived threat related to the detected cyber-threat;
enrich the initial information with the obtained textual information to form textual threat information;
normalize the textual threat information;
vectorize the normalized textual threat information into a vector; and
classify the at least one perceived threat by mapping the vector to at least one security engine.
10. The cyber-security system of claim 9 , wherein the system is further configured to:
search the plurality of external resources for cyber-threats similar to detected cyber-threat, wherein the search is performing using aliases matching a threat identifier of the detected cyber-threat; and
retrieve from at least one of the plurality of external resources additional information related to the at least one perceived threat, wherein each perceived threat includes any one of: the detected cyber-threat and a cyber-threat similar to the detected cyber-threat.
11. The cyber-security system of claim 9 , wherein each external resource includes include any information source maintained by any one of: cyber research organizations and cyber-security vendors.
12. The cyber-security system of claim 9 , wherein features of the at least one perceived threat include at least any of: a file name and a hash value of the least one perceived threat.
13. The cyber-security system of claim 12 , wherein the system is further configured to:
classify each of the at least one perceived threat using natural language processing.
14. The cyber-security system of claim 9 , wherein the security service includes one vector of a security engine, each representing intent of the detected cyber-threat.
15. The cyber-security system of claim 9 , wherein the system is further configured to:
determine an intent of each of the at least one perceived threat based on the classification.