Reasoning About Future CyberAttacks Through SocioTechnical Hacking Information With the widespread of cyberattack incidents, cybersecurity has become a major concern for organizations. The waste of time, money and resources while organizations counter irrelevant cyber threats can turn them into the next victim of malicious hackers. In addition, the online hacking community has grown rapidly, making the cyber threat landscape hard to keep track of. In this work, we describe an AI tool that uses a temporal logical framework to learn rules that correlate malicious hacking activity with realworld cyber incidents, aiming to leverage these rules for predicting future cyberattacks. The framework considers sociopersonal and technical indicators of enterprise attacks, analyzing the hackers and their strategies when they are planning cyber offensives online. Our results demonstrate the viability of the proposed approach, which outperforms baseline systems by an average F1 score increase of 138%, 71% and 17% for intervals of 1, 2 and 3 days respectively, providing security teams mechanisms to predict and avoid cyberattacks.

Embedding Learning with Heterogeneous Event Sequence for Insider Threat Detection The insider threat is one of the most significant cyber security threats that an organisation can be subject to. The recent research on insider threat detection mostly focuses on finding out anomalousness or abnormal changes from a series of behaviors such as logon, file usage and USB connection. Such behaviors can be described as time series set of different types of events, which we call heterogeneous event sequence. Due to the lack of intrinsic temporal relationship measures among events that contain multiple entities with categorical values, most existing work extracts action categorical values within the heterogeneous event to calculate abnormal scores for action sequences. Different from previous work, we synthetically consider multiple entities within the heterogeneous event and propose a principled and probabilistic model IPHE (Insider threat detection via Probabilistic pairwise interaction and Heterogeneous Eventxe2x80x99s entity embedding) that models the likelihood of heterogeneous event sequence. The model embeds entities of heterogeneous events into a common latent space to preserve nonlinear relationships between heterogeneous temporal events. Then the likelihood of heterogeneous event sequence can be computed by the pairwise interactions of different entities of heterogeneous event according to entity embeddings. In particular, due to the imbalance of the occurrence rates of different types of events, we propose typewise learning rate for IPHE to adjust step size during model optimization procedure. Experiment results on the CMUCERT insider threat dataset prove the effectiveness of our proposed approach over competitive baselines.