BRON - Link and evaluate public threat and mitigation data for Cyber Hunting

Threat data from MITRE ATT&CK, CAPEC, CWE , CVE, MITRE Engage, MITRE D3FEND, MITRE CAR and , exploitdb data sources are linked together in a graph called BRON. The data types are linked with bidirectional edges. Orange nodes in figure have "offensive" information. Blue nodes in figure are "defensive" information.

Deployment

See graph_db for a public instance of graph data base implementaion bron.alfa.csail.mit.edu

Ubuntu

```

Python

sudo apt install python3 pyhton3-venv python3-dev

Arango

curl -OL https://download.arangodb.com/arangodb310/DEBIAN/Release.key sudo apt-key add - < Release.key echo 'deb https://download.arangodb.com/arangodb310/DEBIAN/ /' | sudo tee /etc/apt/sources.list.d/arangodb.list sudo apt-get install apt-transport-https sudo apt-get update sudo apt-get install arangodb3=3.10.2-1

Python venv

python3 -m venv ~/.venvs/BRON-dev

Activate venv

source ~/.venvs/BRON-dev/bin/activate

Pythonpath

export PYTHONPATH=.

BRON environment variables

export BRONPWD={The password you set when you installed arango} export BRONSERVER_IP=127.0.0.1 ```

Build BRON python3 tutorials/build_bron.py --username=root --password=${BRON_PWD} --ip=${BRON_SERVER_IP}

Test python -m unittest tests.test_bron_graph_db

Docker

Pre-requisites: - Docker (installing Docker) - Docker Compose (installing Compose)

To deploy BRON on top of ArangoDB, clone this repository and run: docker-compose up -d

The deployment starts two containers: - brondb: an ArangoDB server hosting the BRON graph and collections - bootstrap: an ephemeral container that builds BRON and loads it into the graph database

It may take a few minutes for the bootstrap to conclude. It will download and analyze the required datasets, build BRON, and import it into the database. You can check its completion by monitoring the bootstrap container logs. docker logs -f bootstrap To access the graph database console, point your browser to http://localhost:8529, login, and select BRON as database.

Note: this deployment uses docker secrets for setting the database password; its value can be changed in ./graph_db/arango_root_password.

Programmatic APIs Installation

Python version > = 3.8

Pip

• Create a pip environment python3 -m venv bron_venv source ./bron_venv/bin/activate pip install -r requirements.txt

Getting Started

Build BRON on localhost (requires an arangodb installation) python tutorials/build_bron.py --username root --password $(cat arango_root_password) --ip 127.0.0.1 tail -n 1 build_bron.log

This should produce a build_bron.log file that ends with END building BRON.

Tutorials

Tutorials are available in the tutorials folder on the following topics: - Using BRON in Arangodb, tutorials/using_bron_graphdb.py

Usage

``` usage: buildbron.py [-h] --username USERNAME --password PASSWORD --ip IP [--clean] [--cleanlocalfiles] [--deletemitigations] [--nodownload] [--noparsing] [--nobuilding] [--noarangodb] [--nomitigations] [--novalidation]

Build BRON in Arango DB

optional arguments: -h, --help show this help message and exit --username USERNAME DB username --password PASSWORD DB password --ip IP DB IP address --clean Clean all files and db --cleanlocalfiles Clean all local files --deletemitigations Clean all mitigation collections --nodownload Do not download data --noparsing Do not parse data --nobuilding Do not build BRON --noarangodb Do not create and import to Arangodb --nomitigations Do not create and import mitigations --no_validation Do not validate entries imported to the ArangoDb ```

Structure of BRON

See graph_db/schemas

Bibliography

arXiv report: https://arxiv.org/abs/2010.00533

@misc{hemberg2021linking, title={Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting}, author={Erik Hemberg and Jonathan Kelly and Michal Shlapentokh-Rothman and Bryn Reinstadler and Katherine Xu and Nick Rutar and Una-May O'Reilly}, year={2021}, eprint={2010.00533}, archivePrefix={arXiv}, primaryClass={cs.CR} }