Incorporating Taxonomies of Cyber Incidents Into Detection Networks for Improved Detection Performance

2025-08-13

AI Summary

This work addresses the precision-recall trade-off in network intrusion detection, arising from the inherent diversity of cyber threats. Methodologically, we propose a novel detection framework that deeply integrates a cybersecurity incident taxonomy into the architectural design of detection networks. Guided by the taxonomy’s hierarchical semantic structure, we jointly leverage ontology-based analysis and controlled simulations to systematically identify the optimal operational equilibrium for detection strategies. Our key contribution is the first principled elevation of taxonomies from static labeling tools to structural priors embedded within detection models—explicitly encoding semantic relationships and evolutionary pathways among threat behaviors. Empirical evaluation across multiple public benchmark datasets demonstrates substantial improvements in holistic detection performance (average F1-score gain of 12.7%). Moreover, our analysis uncovers fundamental theoretical limits on detection set construction and establishes an interpretable pathway for performance optimization.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Search and Optimization: Distributed Search
• Knowledge Representation and Reasoning: Ontologies

Application Category

• Web Mining and Content Analysis: Models for Web evolution
• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Semantics and Knowledge: Scalable techniques for the creation, curation, publication, maintenance, and consumption of large, Web-based, structured, reusable, knowledge graphs and ontologies

Abstract

Many taxonomies exist to organize cybercrime incidents into ontological categories. We examine some of the taxonomies introduced in the literature; providing a framework, and analysis, of how best to leverage different taxonomy structures to optimize performance of detections targeting various types of threat-actor behaviors under the umbrella of precision and recall. Networks of detections are studied, and results are outlined showing properties of networks of interconnected detections. Some illustrations are provided to show how the construction of sets of detections to prevent broader types of attacks is limited by trade-offs in precision and recall under constraints. An equilibrium result is proven and validated on simulations, illustrating the existence of an optimal detection design strategy in this framework.

Problem

• Leverage taxonomies to optimize cyber threat detection performance
• Study detection networks for interconnected threat behavior analysis
• Prove optimal detection strategy under precision-recall trade-offs

Innovation

• Leveraging taxonomies to optimize detection performance
• Studying networks of interconnected detections
• Proving optimal detection design strategy equilibrium