# Knowledge mining of unstructured information: application to cyber-domain

arXiv: https://arxiv.org/abs/2109.03848 · HTML: https://mlsanity.com/paper/2109.03848/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 54 references that are in the map.
- First posted on arXiv 8 Sep 2021.

## Builds on (most cited first, 9 of 9)

- [RelExt: Relation Extraction using Deep Learning approaches for Cybersecurity Knowledge Graph Improvement](https://mlsanity.com/paper/1905.02497/) (2019)
- [MALOnt: An Ontology for Malware Threat Intelligence](https://mlsanity.com/paper/2006.11446/) (2020)
- [Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence](https://mlsanity.com/paper/2103.03530/) (2021)
- [Cyber-All-Intel: An AI for Security related Threat Intelligence](https://mlsanity.com/paper/1905.02895/) (2019)
- [Mining Threat Intelligence about Open-Source Projects and Libraries from Code Repository Issues and Bug Reports](https://mlsanity.com/paper/1808.04673/) (2018)
- [Information Extraction in Illicit Domains](https://mlsanity.com/paper/1703.03097/) (2017)
- [ICDM 2019 Knowledge Graph Contest: Team UWA](https://mlsanity.com/paper/1909.01807/) (2019)
- [Constructing Ontology-Based Cancer Treatment Decision Support System with Case-Based Reasoning](https://mlsanity.com/paper/1812.01891/) (2018)
- [Parser Extraction of Triples in Unstructured Text](https://mlsanity.com/paper/1811.05768/) (2018)

## Abstract (arXiv)

Information on cyber-related crimes, incidents, and conflicts is abundantly available in numerous open online sources. However, processing the large volumes and streams of data is a challenging task for the analysts and experts, and entails the need for newer methods and techniques. In this article we present and implement a novel knowledge graph and knowledge mining framework for extracting the relevant information from free-form text about incidents in the cyberdomain. The framework includes a machine learning based pipeline for generating graphs of organizations, countries, industries, products and attackers with a non-technical cyber-ontology. The extracted knowledge graph is utilized to estimate the incidence of cyberattacks on a given graph configuration. We use publicly available collections of real cyber-incident reports to test the efficacy of our methods. The knowledge extraction is found to be sufficiently accurate, and the graph-based threat estimation demonstrates a level of correlation with the actual records of attacks. In practical use, an analyst utilizing the presented framework can infer additional information from the current cyber-landscape in terms of risk to various entities and propagation of the risk heuristic between industries and countries.