Knowledge Graph-based Explainable-AI Framework for Critical Infrastructure Systems (CIS) Security
We aim to develop an innovative framework that combines knowledge graphs (KG) and explainable artificial intelligence (XAI) techniques to enhance the safety, reliability, and explainability of critical infrastructure systems, such as power grid, water, gas, transportation, and defense systems. With the increasing complexity and interdependencies of these systems, it is crucial to have a comprehensive understanding of their functionality and potential risks coming from adversaries. Our objective is to create a robust framework that leverages KGs to represent and model critical infrastructure systems, enabling better decision-making and risk management. By integrating XAI techniques, the framework will provide transparent and interpretable insights into the behavior and functioning of these systems, ensuring their reliability and resilience. Developed framework will enhance the safety and reliability of critical infrastructure systems by providing advanced monitoring, risk assessment, and maintenance capabilities. Secondly, the framework's explainability features will foster trust and acceptance among stakeholders, enabling better collaboration and decision-making. Moreover, the project will contribute to the broader research community by advancing the field of knowledge-based AI and explainable AI.
PI: Dr. Erdogan Dogdu, Co-PI: Dr. Roya Choupani
Aug 2024 - June 2026
Funding Agency: DoD/ARL
Cyber Threat Intelligence Framework Based on Cybersecurity Knowledge Graph
Facing the dynamic complex cyber physical systems (CPS) and environments, internal and external cyber threat intelligence, and the increasing risk of cyber-attacks, knowledge graphs (KG) show great application potential in the cyber security area because of their capabilities in knowledge aggregation, representation, management, and reasoning. While there is a large body of work in the area of utilizing KGs to represent knowledge in cybersecurity, termed as Cybersecurity Knowledge Graphs (CSKG), it is not clear yet how they will be utilized in solving real cyber-attack and defense scenarios. Most CSKGs developed earlier are incomplete, mostly developed using a top-down approach and difficult to sustain due to manual maintenance. We earlier developed a tool that is agent-based and autonomously collects information from a network infrastructure to build a dynamic CSKG. In this project we will advance our earlier work to design and implement a comprehensive Cyber Threat Intelligence Framework Based on CSKG, with capabilities including (a) threat and risk identification and assessment using AI/ML methods such as KG-completion via semantic reasoning, graph embedding methods, and graph neural networks, (b) federated learning using multiple CSKGs from the same or interconnected domains, transfer learning methods, (c) log analysis in conjunction with CSKG towards explainable AI.
PI: Dr. Roya Choupani Co-PI: Dr. Erdogan Dogdu,
Aug 2024 - June 2026
Funding Agency: DoD/ARL
The Unified Cybersecurity Knowledge Graph (UCKG) is a comprehensive knowledge graph aimed at collecting, integrating, and unifying diverse cybersecurity knowledge resources. It addresses the difficulty of managing the heterogeneous data produced in the cybersecurity field by providing a unified knowledge resource for intelligent solutions.
The UCKG uses the Unified Cybersecurity Ontology (UCO) as its foundational vocabulary and ontology to integrate various open data sources in an automated fashion. These integrated sources include structured data such as Common Vulnerabilities Enumeration (CVE), Common Weakness Enumeration (CWE), Mitre ATT&CK and D3FEND, Common Attack Pattern Enumeration and Classification (CAPEC), Common Platform Enumeration (CPE), and Common Vulnerability Scoring System (CVSS).
By acting as a unified, integrated knowledge source, the UCKG aims to pave the way for intelligent cybersecurity applications, including cyber threat intelligence modeling, risk assessment, attack flow analysis, and the discovery of new vulnerabilities.