The anatomy of cyber threats: a natural language approach to asset-based threat modelling

Abstract

The pervasiveness and criticality of emerging technologies throughout personal life, business, government and defence, is generating a growing demand for more advanced cyber threat detection, analysis and response capabilities. Threat modelling is a core component of these activities, and asset-based threat modelling in particular constitutes a primary methodological approach for characterising and understanding cyber threats in a broad range of technological and industrial domains. However, existing asset-based threat modelling processes typically exhibit a range of methodological limitations which can significantly constrain the validity of any resultant threat models.

Accordingly, this work develops and presents a generalised Reference Framework for Asset-based Threat Modelling (ReFAThM) intended to guide the development of such threat models, evaluate their completeness, and thus improve their robustness. We also present a novel automated method for characterising the threat landscape using topic modelling. Here, the CWE dataset is used as ground-truth and is pre-processed to synthesise 12 text-based threat attributes for each, using an LLM. These combined attributes constitute the input to topic modelling. Following a cluster merging process, this yields a concise set of 19 threat types, without undermining the breadth and depth of the originating vulnerability dataset. In a subsequent research activity, we utilise these 19 clusters in a classification paradigm to conduct feature importance analysis over the original 12 threat attributes. We quantitatively establish that the ’vulnerability’, ’countermeasures’, ’detection method’, ’technical impact’ and ’relevant assets’ are the most important threat attributes when characterising a cyber threat. These findings are then employed within an ontology engineering process to develop a ’core threat model’ which is suitable to form the basis of more specialised asset-based threat models in a broad range of domains.

More information

Identifiers

ORCID for Tom James Bell: orcid.org/0000-0001-6027-2065

ORCID for vladi Sassone: orcid.org/0000-0002-6432-1482

Catalogue record

Export record