Open source intelligence is a powerful tool for cybersecurity analysts to gather information both for analysis of discovered vulnerabilities and for detecting novel cybersecurity threats and exploits. Here, we present a Neo4j graph database formed by shared connections (shared sub-string matches) between open source intelligence text including blogs, cybersecurity bulletins, news sites, antivirus scans, social media posts (such as Reddit and Twitter), and threat reports. These connections are comprised of possible indicators of compromise (IP addresses, domains, hashes, email addresses, phone numbers), information on known exploits and techniques (CVEs and MITRE ATT\&CK Technique IDs), and potential sources of information on cybersecurity exploits such as twitter usernames. The construction of the database of potential IOCs is detailed. Examples of utilizing the graph database for querying connections between known malicious IOCs and open source intelligence documents, including threat reports, are shown. We show that this type of relationship querying can allow for more effective use of open source intelligence for threat hunting, malware family clustering, and vulnerability analysis. We show four specific examples of interesting connections found in the graph database; the connections to a known exploited CVE, a known malicious IP address, a malware hash signature, and a portable executable shared resource file.

翻译：开源情报是网络安全分析师收集信息的有力工具，既可用于分析已发现的漏洞，也可用于检测新型网络安全威胁与攻击手法。本文构建了一个Neo4j图数据库，其节点间的关联（共享子字符串匹配）建立于开源情报文本之上，涵盖博客、网络安全公告、新闻网站、反病毒扫描结果、社交媒体帖子（如Reddit和Twitter）以及威胁报告。这些关联包含潜在入侵指标（IP地址、域名、哈希值、电子邮件地址、电话号码）、已知攻击手法与利用技术的信息（CVE编号和MITRE ATT&CK技术ID），以及可能的网络安全攻击信息来源（如Twitter用户名）。本文详述了潜在IOC数据库的构建过程，并展示了如何利用该图数据库查询已知恶意IOC与开源情报文档（包括威胁报告）之间的关联。研究表明，此类关系查询能够更有效地利用开源情报进行威胁狩猎、恶意软件家族聚类和漏洞分析。我们给出了图数据库中发现的四个具体关联示例：与已知被利用CVE的关联、与已知恶意IP地址的关联、与恶意软件哈希签名的关联，以及与可移植可执行文件共享资源文件的关联。