What question did this study set out to answer?

The aim is to evaluate how effective algorithmic de-anonymization attacks are on open cyber threat intelligence graphs.

March 10, 20260 citationsOpen Access

Algorithmic De-Anonymization in Open Cyber Threat Intelligence Graphs

CGConnor GladishUniversity of Tennessee at Martin

Key Points

The aim is to evaluate how effective algorithmic de-anonymization attacks are on open cyber threat intelligence graphs.
Systematic empirical evaluation of existing CTI graph data
Analysis of graph topology, including degree sequences, neighborhood structure, and clustering patterns
Comparison of attacks with various anonymization techniques applied
Graph topology alone allows for high-confidence re-identification of entities
Anonymization procedures like identifier permutation and attribute redaction are insufficient
Identities can be reconstructed even when identifiers are removed

Abstract

This paper presents the first systematic empirical evaluation of algorithmic de-anonymization attacks against open cyber threat intelligence (CTI) graphs. Cyber threat intelligence sharing platforms such as MISP and OpenCTI routinely publish graph-structured data after applying anonymization procedures including identifier permutation and attribute redaction. This work demonstrates that graph topology alone — degree sequences, neighborhood structure, and clustering patterns — is sufficient to re-identify entities with high confidence, even when all string identifiers have been removed.

问 AI

Bookmark

View Full Paper