KnowledgeBase

Description

Solution for managing and integrating data from unstructured sources in the field of Cyber Situation Awareness through the use of a Knowledge Graph. The primary objective is the design and development of a system that supports users in achieving a high level of Situation Awareness by automatically and reliably processing textual reports on Advanced Persistent Threats (APTs) based on malware. The platform enables users to query and extract critical information for threat analysis and management using natural language queries, providing actionable insights in a timely and efficient manner.

Prerequisites

Before running the system, make sure you have the necessary setup:

1. Install Docker Ensure that Docker is installed and running on your system.

2. Install Neo4j Desktop Download and install Neo4j Desktop on your system.

3. Create Constraint Open the Neo4j Browser and execute the following command

CREATE CONSTRAINT n10s_unique_uri FOR (r:Resource) REQUIRE r.uri IS UNIQUE;

Getting Started Clone the repository

git clone https://github.com/Alejandro175/KnowledgeBase.git
cd KnowledgeBase

Create the .env file Below is an example template — to run the system, you must provide your OpenAI API key and the Neo4j database credentials:

PROJECT_PREFIX=knowledgebase

# Pipeline
MODELS_DIR=/code/cache/huggingfacenv2.5
ONTOLOGY_FILE_PATH=/code/app/pipeline/ontology/malwareOntology.rdf
NER_MODEL=gliner-community/gliner_large-v2.5

# LLM Configuration
OPENAI_API_KEY=YOUR-OPENAI-KEY
RELATION_EXTRACTION_LLM=gpt-4o-mini
ANSWER_LLM=gpt-4o

# Neo4j Configuration
NEO4J_URI=bolt://host.docker.internal:7687
NEO4J_USERNAME=YOUR-NEO4J-USERNAME
NEO4J_PASSWORD=YOUR-NEO4J-PASSWORD
NEO4J_DATABASE=YOUR-NEO4J-DATABASE

⚠️ Replace YOUR-OPENAI-KEY with your OpenAI API key, YOUR-NEO4J-USERNAME with the username of your Neo4j database, YOUR-NEO4J-DATABASE with the name of your Neo4J database and YOUR-NEO4J-PASSWORD with the password of your Neo4j database,

Build and launch the pipeline

docker compose up --build

Access the Streamlit app Open your browser and go to: http://localhost:8501

Use Cases

1. Identification of Indicators of Compromise (IoC)

Find elements that may indicate the presence of a particular malware, including:

• Suspicious URLs
• IP addresses
• Malicious files
• Hashes (MD5, SHA-1, SHA-256)
• Other indicators of compromise

Example Query:

"What are the indicators of the malware cloud atlas?"

2. Identification of Targets

Identify the possible targets of a malware in terms of:

• Compromised systems and infrastructures
• Vulnerable software
• Specific files
• Sensitive information

Example Query:

"What are the targets of the malware cloud atlas?"

3. Analysis of Malware Characteristics

Determine the technical and behavioral characteristics of a particular malware, including:

• Attack methodologies
• Related Attack Patterns
• Capabilities
• Related malware families

Example Query:

"What are the characteristics of the malware cloud atlas?"