# Leveraging Semantic Relationships to Prioritise Indicators of Compromise in Additive Manufacturing Systems

arXiv: https://arxiv.org/abs/2305.04102 · HTML: https://mlsanity.com/paper/2305.04102/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 28 references that are in the map.
- First posted on arXiv 6 May 2023.

## Builds on (most cited first, 3 of 3)

- [Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligence](https://mlsanity.com/paper/2010.13637/) (2020)
- [dr0wned - Cyber-Physical Attack with Additive Manufacturing](https://mlsanity.com/paper/1609.00133/) (2016)
- [Decaying Indicators of Compromise](https://mlsanity.com/paper/1803.11052/) (2018)

## Abstract (arXiv)

Additive manufacturing (AM) offers numerous benefits, such as manufacturing complex and customised designs quickly and cost-effectively, reducing material waste, and enabling on-demand production. However, several security challenges are associated with AM, making it increasingly attractive to attackers ranging from individual hackers to organised criminal gangs and nation-state actors. This paper addresses the cyber risk in AM to attackers by proposing a novel semantic-based threat prioritisation system for identifying, extracting and ranking indicators of compromise (IOC). The system leverages the heterogeneous information networks (HINs) that automatically extract high-level IOCs from multi-source threat text and identifies semantic relations among the IOCs. It models IOCs with a HIN comprising different meta-paths and meta-graphs to depict semantic relations among diverse IOCs. We introduce a domain-specific recogniser that identifies IOCs in three domains: organisation-specific, regional source-specific, and regional target-specific. A threat assessment uses similarity measures based on meta-paths and meta-graphs to assess semantic relations among IOCs. It prioritises IOCs by measuring their severity based on the frequency of attacks, IOC lifetime, and exploited vulnerabilities in each domain.