摘要
資安威脅情報 (Cyber Threat Intelligence, CTI) 一直以來是惡意行為分析與資訊安全防禦上不可或缺的重要資訊參考。資安威脅情報可協助企業了解網路攻擊入侵所使用之戰略、手法及程序，進一步制定防禦政策及機制。知名入侵威脅描述框架—— MITRE ATT CK ——從真實的網路攻擊事件案例中收集並彙整了大量資安威脅相關情報，提供一個框架式的網路及系統攻擊概觀，以易於理解的矩陣格式將一些已知的攻擊事件經分析並以其攻擊戰術和手法歸類綜整後，呈現惡意攻擊的戰術、手法及相關案例簡約的特徵描述。為讓資安威脅情報能夠有效地被分享與使用，它們需要有結構化的正規化表達方式。本論文提出利用知識本體論 (ontology) 建立 MITRE ATT CK 資安威脅情報的知識本體庫，以達到知識分享共用的目的。本論文將從 MITRE ATT CK 網站上收集資料，依據三個重要常用的查詢模式所需資源，利用 Web Ontology Language (OWL) 定義已知資安威脅的術語 (knowledge terms) 所組成的概念集合 (a set of concepts) 與關聯 (relations)；最後將為所有資料實例建立其知識本體資源，進而建構出完整的 MITRE ATT CK 知識本體庫。本論文最後以網頁介面實作一基於該知識本體庫的知識查詢系統，以利使用者簡單、方便及快速獲得欲查詢的 MITRE ATT CK 資安威脅情報。
並列摘要
Cyber Threat Intelligence (CTI) information has always been an indispensable and primary reference for malicious behavior analysis and cyber security defense. CTI information could help enterprises understand the Tactics, Techniques and Procedures used by the cyber attacks and intrusions, and further formulate policies and mechanisms to defend against them. A well-known cyber security framework – MITRE ATT CK – has collected and integrated a large amount of CTI related information from real cases of cyber attacks. MITRE ATT CK provides a framework-based overview of cyber attacks by presenting their Tactics, Techniques and Procedure Examples. In order for CTI information to be effectively shared and used, they need to have structural and formal representations. This thesis proposes to construct an ontology of MITRE ATT CK in order to achieve the purpose of knowledge sharing. In our work, data are collected from the MITRE ATT CK website. We use Web Ontology Language (OWL) to define a set of concepts and relations, which are composed of known CTI knowledge terms, based on the resource requirement of three important query modes. Finally, we will build up ontological resources for all data instances and further construct a complete MITRE ATT CK ontology. At the end of the thesis, the thesis implements a web-based knowledge query system based on the constructed MITRE ATT CK ontology, enabling users an easy-to-use user interface (UI) to obtain the desired CTI information.