Fully homomorphic encryption (FHE) allows neural network inference to be performed directly on encrypted data and models, preserving end-to-end privacy. One of the most widely used FHE schemes, CKKS, supports approximate arithmetic over real numbers and is well-suited for computing polynomial operations. However, CKKS does not natively support conditional branching, making it unsuitable for non-linear functions such as ReLU, which behaves differently depending on whether the input is negative or nonnegative. To address this, ReLU is typically approximated using polynomials. Unfortunately, this approach introduces two key drawbacks: (1) the approximation is only valid within a certain input range, and (2) identifying this range typically requires prior exposure of cleartext data to perform profiling, thus partially compromising privacy. This requirement is problematic in practice, as small profiling errors can lead to substantial accuracy degradation. On the other hand, the TFHE scheme supports binary gate-level computation, enabling precise implementation of conditional operations such as ReLU. Yet TFHE lacks the SIMD capabilities of CKKS, leading to significant computational latency. This paper explores the use of scheme switching for encrypted neural network inference: leveraging CKKS for polynomial-compatible layers and switching to TFHE for layers that require conditional logic, such as ReLU. We demonstrate that this hybrid approach substantially improves the numerical fidelity of encrypted neural network inference: while polynomial approximations suffer from numerical divergence, scheme switching more closely matches non-encrypted inference.

Attack graph-based methods are a promising approach towards discovering attacks and various techniques have been proposed recently. A key limitation, however, is that approaches developed so far are monolithic in their architecture and heterogeneous in their internal models. The inflexible custom data models of existing prototypes and the implementation of rules in code rather than declarative languages on the one hand make it difficult to combine, extend, and reuse techniques, and on the other hand hinder reuse of security knowledge – including detection rules and threat intelligence. KRYSTAL tackles these challenges by providing a knowledge graph-based, modular framework for threat detection, attack graph and scenario reconstruction, and analysis based on RDF as a standard model for knowledge representation. This approach provides query options that facilitate contextualization over internal and external background knowledge, as well as the integration of multiple detection techniques, including tag propagation, attack signatures, and graph queries. We implemented our framework in an openly available prototype and demonstrate its applicability on multiple scenarios of the DARPA Transparent Computing dataset. Our evaluation shows that the combination of different threat detection techniques within our framework improved detection capabilities. Furthermore, we find that RDF provenance graphs are scalable and can efficiently support a variety of threat detection techniques.

Security professionals rely extensively on log data to monitor IT infrastructures and investigate potentially malicious activities. Existing systems support these tasks by collecting log messages in a database, from where log events can be queried and correlated. Such centralized approaches are typically based on a relational model and store log messages as plain text, which offers limited flexibility for the representation of heterogeneous log events and the connections between them. A knowledge graph representation can overcome such limitations and enable graph pattern-based log analysis, leveraging semantic relationships between objects that appear in heterogeneous log streams. In this paper, we present a method to dynamically construct such log knowledge graphs at query time, i.e., without a priori parsing, aggregation, processing, and materialization of log data. Specifically, we propose a method that – for a given query formulated in SPARQL – dynamically constructs a virtual log knowledge graph directly from heterogeneous raw log files across multiple hosts and contextualizes the result with internal and external background knowledge. We evaluate the approach across multiple heterogeneous log sources and machines and see encouraging results that indicate that the approach is viable and facilitates ad-hoc graph-analytic queries in federated settings.

Abstract This paper introduces an evolving cybersecurity knowledge graph that integrates and links critical information on real-world vulnerabilities, weaknesses and attack patterns from various publicly available sources. Cybersecurity constitutes a particularly interesting domain for the development of a domain-specific public knowledge graph, particularly due to its highly dynamic landscape characterized by time-critical, dispersed, and heterogeneous information. To build and continually maintain a knowledge graph, we provide and describe an integrated set of resources, including vocabularies derived from well-established standards in the cybersecurity domain, an ETL workflow that updates the knowledge graph as new information becomes available, and a set of services that provide integrated access through multiple interfaces. The resulting semantic resource offers comprehensive and integrated up-to-date instance information to security researchers and professionals alike. Furthermore, it can be easily linked to locally available information, as we demonstrate by means of two use cases in the context of vulnerability assessment and intrusion detection.