APT BRON Relation Extraction

Relation extraction from APT reports for the BRON knowledge graph

The BRON Graph

Many public sources of cyber threat and vulnerability information exist to help defend cyber systems. This paper links MITRE's ATT&CK MATRIX of Tactics and Techniques, NIST's Common Weakness Enumerations (CWE), Common Vulnerabilities and Exposures (CVE), and Common Attack Pattern Enumeration and Classification list (CAPEC), to gain further insight from alerts, threats and vulnerabilities. We preserve all entries and relations of the sources, while enabling bi-directional, relational path tracing within an aggregate data graph called BRON. In one example, we use BRON to enhance the information derived from a list of the top 10 most frequently exploited CVEs. We identify attack patterns, tactics, and techniques that exploit these CVEs and also uncover a disparity in how much linked information exists for each of these CVEs. This prompts us to further inventory BRON's collection of sources to provide a view of the extent and range of the coverage and blind spots of public data sources.

Useful Links

Data Sources

Data Source	Explanation
BRON Knowledge Graph	Threat data from MITRE ATT&CK, CAPEC, CWE , CVE, MITRE Engage, MITRE D3FEND, MITRE CAR and exploitdb data sources are linked together in a graph called BRON.
APTnotes	APTnotes is a repository of publicly-available papers and blogs (sorted by year) related to malicious campaigns/activity/software that have been associated with vendor-defined APT (Advanced Persistent Threat) groups and/or tool-sets.
MITRE ATT&CK Matrix	Tactics and techniques representing the MITRE ATT&CK® Matrix for Enterprise.

Types of Nodes

Type	Explanation
Tactic	A high-level objective that an adversary tries to achieve during a cyberattack (e.g., initial access, privilege escalation, data exfiltration)
Group	A known threat actor or cybercriminal organization, tracked by MITRE based on its tactics, techniques, and procedures (TTPs) (e.g., APT29, Lazarus Group)
Software	Malicious tools, malware, or utilities used by adversaries, including publicly available software and custom tools, categorized within the MITRE ATT&CK framework. (e.g., Mimikatz, Industroyer)
Technique	A specific method or approach used by attackers to accomplish a tactic, detailing how adversaries achieve their goals (e.g., phishing, credential dumping)
CAPEC	A structured catalog of common attack patterns that adversaries use to exploit system weaknesses, focusing on how attacks are executed (e.g., Server Side Include (SSI) Injection, Data Serialization External Entities Blowup)
CWE	The Common Weakness Enumeration (CWE) is a MITRE list that categorizes software and hardware security weaknesses that could lead to vulnerabilities (e.g., Incorrect Behavior Order: Authorization Before Parsing and Canonicalization, Improper Handling of Parameters
CVE	The National Vulnerability Database (NVD) provides detailed information about known vulnerabilities in real products (CVE - Common Vulnerabilities and Exposures), including severity ratings and mitigation steps (e.g., CVE-2022-25454, CVE-2025-24201)
CPE	The Common Platform Enumeration (CPE) is a standardized naming scheme used by NVD to identify and describe hardware, software, and firmware affected by vulnerabilities (e.g., [cpe:2.3:a:apple:safari:17.6:::::::*])

Task

The goal is to extract new edges from the reports to enrich the BRON knowledge graph.

Possible Implementation Techniques

NER (Named Entity Recognition is a natural language processing (NLP) technique that identifies and classifies key elements (in our case attack patterns, cves, weaknesses, etc...) within unstructured text.

Output Format

The output format should be a JSON file that contains a list of edges of the following schema:

[
  {
    "from": "node1_id",
    "to": "node2_id",
    "source": ["source_doc1", "source_doc2", "..."],
    "justification": "optional - why is node1 connected to node2"
  },
  "..."
]

Getting Started

Get your own BRON

To get access to the BRON graph, and have it locally so you can query it when needed, you should load the BRON graph to your machine. Follow the steps below:

1. Download Neo4j - this is the client you will use in order to load BRON, and explore it manually or via python code.
2. Download BRON - you will load the BRON knowledge graph from this file that contains all the information about it in Neo4j language.
3. Add BRON dump to the client - in the Neo4j client: Add -> File -> (choose bron dump)
4. Create database from the dump - in the Neo4j cleint: Click on the ... icon next to the BRON dump file -> Create new DBMS from dump
5. Create a .env file (in the root directory) with the following variables:

   NEO4J_URI="neo4j://localhost:{PORT}"
   NEO4J_USERNAME="{USERNAME}"
   NEO4J_PASSWORD="{PASSWORD}"

   Replace {PORT}, {USERNAME}, and {PASSWORD} according to your settings and how you set up the graph in step 4.
6. To verify you did everything correctly, run the test located in src/neo4j_test.py.

Project Requirements

• You should use Python 3.13.2
• Create a virtual environment: python -m venv .venv
• Install dependencies: pip install -r requirements.txt - make sure to update this file if you add more dependencies

Useful Guides

Neo4j

• Neo4j Python Package - this is the python package you will use in order to interface with the BRON graph.
• Cypher Docummentation (Neo4j Query Language) - this is the language you will use to query the graph (e.g., getting nodes, relationships, etc...)

Docling

To convert PDFs into raw text to perform extraction, there are numerous packages to use. One great option is Docling. Docling simplifies document processing, parsing diverse formats — including advanced PDF understanding — and providing seamless integrations with the gen AI ecosystem.

NLP Tools

• NLTK - General NLP libreary with some pretrained models and functions useful for processing language
• CyNER - NER tool trained by IBM in 2022 to extract security entities from reports, looks good but I didn't try it