Learning maliciousness in cybersecurity graphs
Systems and methods for utilizing statistical relational learning techniques in order to predict factors for nodes of a node graph, such as a node graph that represents attacks and incidents to a computing system, are described. In some embodiments, the systems and methods identify certain nodes (of a node graph) as representing malicious attributes of an email or other threat artifact received by a computing system or network and utilize relational learning to predict the maliciousness of attributes represented by other nodes (of the node graph).
1. A non-transitory computer-readable medium whose contents, when executed by a hardware processor, cause the hardware processor to perform a method for mitigating attacks on a computing system, the method comprising:
generating a node graph for a threat artifact received by the computing system, wherein the node graph includes a plurality of nodes including a first node representing the threat artifact and second nodes representing attributes derived from the threat artifact, and edges that each represent a relationship between two of the nodes, wherein the attributes describe the threat artifact, and wherein one of the second nodes representing the attributes is assigned a predicted maliciousness value based on known maliciousness values of multiple other of the plurality of nodes of the node graph; and
performing an action based on an analysis of the node graph to dynamically adjust security operations of the computing system.
2. The non-transitory computer-readable medium of claim 1 , wherein the method further comprises:
combining the generated node graph with another node graph into a composite node graph, wherein the composite node graph includes one or more intermediate nodes that join unique instances of attributes derived from different artifacts received by the computing system.
3. The non-transitory computer-readable medium of claim 1 , wherein the node graph includes nodes having weights associated with corresponding determined maliciousness values assigned to the attributes represented by the nodes, and wherein the predicted maliciousness value for the one of the second nodes is based on the weights assigned to the attributes represented by the multiple other of the plurality of nodes of the node graph.
4. The non-transitory computer-readable medium of claim 1 , wherein assigning the predicted maliciousness value based on the known maliciousness values of the multiple other of the plurality of nodes of the node graph to the one of the second nodes includes using relational learning to determine a predicted maliciousness factor for the at least one of the second nodes.
5. The non-transitory computer-readable medium of claim 1 , wherein assigning the predicted maliciousness value based on the known maliciousness values of the multiple other of the plurality of nodes of the node graph to the one of the second nodes includes assigning the predicted maliciousness value based on topological features and known attributes of neighboring nodes to the at least one of the second nodes.
6. The non-transitory computer-readable medium of claim 1 , wherein assigning the predicted maliciousness value based on the known maliciousness values of the multiple other of the plurality of nodes of the node graph to the one of the second nodes includes:
learning latent relationship, node, and attribute embeddings for the one of the second nodes by utilizing a latent feature model based on tensor factorization; and
approximating unknown attributes associated with the one of the second nodes based on the latent feature model.
7. The non-transitory computer-readable medium of claim 1 , wherein the threat artifact includes a phishing email.
8. The non-transitory computer-readable medium of claim 1 , wherein generating the node graph for the threat artifact received by the computing system includes generating the node graph for a received phishing email that includes: (1) a node that represents an email, (2) a node that represents a human sender of the email, (3) a node that represents a human recipient of the email, and (4) a node that represents an attachment to the email.
9. The non-transitory computer-readable medium of claim 1 , wherein the method further comprises:
accessing data from one or more data sources external to the computing system and augmenting the node graph with one or more additional nodes that represent data from the one or more data sources that is related to information associated with one or more nodes of the node graph.
10. The non-transitory computer-readable medium of claim 1 , wherein performing the action based on the analysis of the node graph to dynamically adjust security operations of the computing system includes performing an action to dynamically adjust or modify operation of security devices of the computing system.
11. A method for mitigating attacks to a computing system, the method comprising:
generating a node graph for a threat artifact received by the computing system, wherein the node graph includes a plurality of nodes including a first node representing the threat artifact and second nodes representing attributes derived from the threat artifact, and edges that each represent a relationship between two of the nodes, wherein the attributes describe the threat artifact, and wherein one of the second nodes representing the attributes is assigned a predicted maliciousness value based on known maliciousness values of multiple other of the plurality of nodes of the node graph; and
performing an action based on an analysis of the node graph to dynamically adjust security operations of the computing system.
12. The method of claim 11 , further comprising:
combining the generated node graph with another node graph into a composite node graph, wherein the composite node graph includes one or more intermediate nodes that join unique instances of attributes derived from different artifacts received by the computing system.
13. The method of claim 11 , wherein the node graph includes nodes having weights associated with corresponding determined maliciousness values assigned to the attributes represented by the nodes, and wherein the predicted maliciousness value for the one of the second nodes is based on the weights assigned to the attributes represented by the multiple other of the plurality of nodes of the node graph.
14. The method of claim 11 , wherein assigning the predicted maliciousness value based on the known maliciousness values of the multiple other of the plurality of nodes of the node graph to the one of the second nodes includes using relational learning to determine a predicted maliciousness factor for the at least one of the second nodes.
15. The method of claim 11 , wherein assigning the predicted maliciousness value based on the known maliciousness values of the multiple other of the plurality of nodes of the node graph to the one of the second nodes includes assigning the predicted maliciousness value based on topological features and known attributes of neighboring nodes to the at least one of the second nodes.
16. The method of claim 11 , wherein assigning the predicted maliciousness value based on the known maliciousness values of the multiple other of the plurality of nodes of the node graph to the one of the second nodes includes:
learning latent relationship, node, and attribute embeddings for the one of the second nodes by utilizing a latent feature model based on tensor factorization; and
approximating unknown attributes associated with the one of the second nodes based on the latent feature model.
17. The method of claim 11 , wherein the threat artifact includes a phishing email.
18. The method of claim 11 , wherein generating the node graph for the threat artifact received by the computing system includes generating the node graph for a received phishing email that includes: (1) a node that represents an email, (2) a node that represents a human sender of the email, (3) a node that represents a human recipient of the email, and (4) a node that represents an attachment to the email.
19. The method of claim 11 , further comprising:
accessing data from one or more data sources external to the computing system and augmenting the node graph with one or more additional nodes that represent data from the one or more data sources that is related to information associated with one or more nodes of the node graph.
20. A system, comprising:
a memory; and
a hardware processor coupled to the memory and configured to:
access multiple threat artifacts associated with a network of computing resources;
generate a single node graph for each of the multiple threat artifacts, wherein the single node graph for each of the multiple threat artifacts includes a plurality of nodes including a first node representing the corresponding threat artifact and second nodes representing attributes derived from the corresponding threat artifact, wherein the attributes describe the corresponding threat artifact, and wherein one of the second nodes is assigned a predicted maliciousness value based on known maliciousness values of multiple neighboring nodes of the single node graph; and
build a composite node graph for the network of computing resources that represents a current threat status of the network of computing resources;
identify one or more attacks to the network of computing resources based on an analysis of the composite node graph; and
mitigate the identified one or more attacks to the network of computing resources.