DefendGraph: Sistema Especialista Semântico para Alertas Wazuh com MITRE D3FEND

• Eduardo K. M. do Canto UFRGS
• Felipe Thomas UFRGS
• Patrick d. S. Almeida UFRGS
• Jeferson C. Nobre UFRGS
• Luciano P. Gaspary UFRGS
• Julião Braga UFABC
• Vinicius Tavares Guimarães IFSul

DOI: https://doi.org/10.5753/sbseg_estendido.2026.33711

Resumo

O crescente grau de complexidade das redes modernas e dos ambientes de cibersegurança impõe desafios significativos à análise e interpretação de alertas gerados por ferramentas de Security Information and Event Management (SIEM). Nesses ambientes, o volume de eventos e a heterogeneidade dos dados dificultam a compreensão do contexto dos incidentes, aumentando a sobrecarga operacional dos analistas e limitando o processo de tomada de decisão. Este artigo apresenta um protótipo de sistema especialista semântico para apoiar a análise de alertas de cibersegurança e a recomendação de medidas defensivas. A abordagem proposta transforma alertas nativos do Wazuh em um grafo de conhecimento RDF/OWL enriquecido com a ontologia MITRE D3FEND, com o objetivo de ampliar a explicabilidade, a rastreabilidade e a representação formal das relações entre evidências observadas, técnicas adversárias e mecanismos de defesa.

Referências

Huang, C.-C., Huang, P.-Y., Kuo, Y.-R., Wong, G.-W., Huang, Y.-T., Sun, Y. S., and Chang Chen, M. (2022). Building Cybersecurity Ontology for Understanding and Reasoning Adversary Tactics and Techniques. In 2022 IEEE International Conference on Big Data (Big Data), pages 4266–4274.

IAB (2025). Report from the iab workshop on the next era of network management operations (nemops). Internet-Draft draft-iab-nemops-workshop-report-04, IAB. Work in progress. Expires: March 2026.

Mackey, M., Claise, B., Voyer, D., Graf, T., and Keller, H. (2025). Knowledge graph framework for network operations. Internet-Draft draft-mackey-nmop-kg-framework-02, IETF. Work in progress.

Martinez-Casanueva, I. D., Claise, B., and Mackey, M. (2025). Knowledge graph construction from network data sources. Internet-Draft draft-marcas-nmop-knowledge-graph-yang-04, IETF. Work in progress.

Mouiche, I., Merbouh, H., and Saad, S. (2025). Context-aware entity-relation extraction pipeline for threat intelligence knowledge graphs. Available at SSRN 5152241.

Pang, R., Zhao, J., and Zhang, S. (2025). Knowledge graph for network traffic monitoring and analysis. Internet-Draft draft-pang-idr-kg-traffic-monitoring-00, IETF. Work in progress.

Tailhardat, L., Chabot, Y., and Troncy, R. (2025). Anomaly Detection using Knowledge Graphs: A Survey for Network Management and Cybersecurity Application. Preprint, HAL. HAL Id: hal-04930539; revised version, 2026.

Tailhardat, L. and Troncy, R. (2025). Knowledge graphs for enhanced cross-operator incident management and network design. Internet-Draft draft-tailhardat-nmop-kg-cross-operator-incident-01, IETF. Work in progress.

Tan, H. (2017). A brief history and technical review of the expert system research. IOP Conference Series: Materials Science and Engineering, 242:012111.

Zheng, M., He, T., Wang, N., Wang, X., and Zuo, J. (2025). Network Security Threat Detection System Based on Knowledge Graph. In 2025 40th Youth Academic Annual Conference of Chinese Association of Automation (YAC), pages 998–1004.