Knowledge-Driven Prediction of Vulnerability Co-Exploitation

Current vulnerability exploitation prediction primarily focuses on the attributes and features of individual vulnerabilities. However, co-exploitation behavior, referring to multiple vulnerabilities being exploited jointly, poses considerable challenges to the prevention and remediation of cyberattacks. It is difficult to directly predict the co-exploitation relationships between vulnerabilities from existing open-source intelligence (OSINT). In this paper, we propose a novel method for predicting the co-exploitation of vulnerabilities using knowledge reasoning based on a knowledge graph. Specifically, we construct a vulnerability knowledge graph, VulCKG, which contains over 355 K nodes and 4 million relational triples. To get the missing critical relational information within the knowledge graph, we designed a knowledge embedding model, AttTransM, that integrates semantic and structural information for knowledge graph completion (KGC). Experimental results show that AttTransM outperforms other popular models across all evaluation metrics. Finally, we apply rule-based reasoning to predict the co-exploitation relationships between vulnerability entities.