VATH: A System for Extracting Relationships between Vulnerabilities and Attackers to Support Threat Hunting

Abstract

Given the finite nature of an organization's security resources, effectively countering all risks can be quite challenging. Threat hunting involves gathering information to make informed decisions about the allocation of security resources. Part of this responsibility for security personnel includes investigating the attack methods made possible by existing vulnerabilities, identifying potential attackers, and understanding their attack strategies. This study aims to support threat hunting efforts, ultimately aiding in the optimal distribution of security resources. To achieve this goal, we propose a system that combines data from NVD (National Vulnerability Database) and MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge). This system enables us to identify the attack methods that could be executed by exploiting specific vulnerabilities and the potential attackers who may leverage these methods. Through several examples, we have verified that the insights provided by our system align with information available from other sources. By leveraging the proposed system, investigations into attack methods and potential attackers can be conducted more efficiently, requiring fewer steps compared to manual investigations.