[🔴 Closed] Round of 16 Cyber Attack Knowledge Graph

âš½GraphAcademy Cup Community Challenge
1

Round of 16: Cyber Attack Knowledge Graph

GraphAcademy Cup Team Profile Link

GraphAcademy | india

GraphAcademy Public Profile Username:

Khanadil84

Country:

India

Courses Completed

Courses
Courses1078×381 25.3 KB

Project Name:

Cyber Attack Knowledge Graph

Project Description:

Cyber Attack Knowledge Graph is a Neo4j-based project that demonstrates graph data modeling for cybersecurity intelligence. The graph models relationships between Threat Groups, Malware, Attack Techniques, CVEs, Software Products, Vendors, Security Patches, Industries, and Countries using a connected knowledge graph.

The project is built from structured CSV datasets imported through reusable Cypher scripts. It enables analysts to trace attack paths from threat actors to exploited vulnerabilities, affected software products, responsible vendors, and available security patches. Using Neo4j's graph model, complex cybersecurity relationships become easier to visualize and query.

The repository contains reusable Cypher scripts, CSV datasets, schema documentation, graph screenshots, and example queries while remaining fully compliant with the Neo4j Round of 16 challenge constraints.

How my project stays within the Rule of 16 maximums

Item Count
Node Labels 9 / 16
Relationship Types 9 / 16
Properties per Element Maximum 4 / 16
Constraints 9 / 16
Source Files 16 / 16

Data Model

Node Labels

Node Label Purpose
ThreatGroup Cyber threat actor information
Malware Malware families
Technique Attack techniques
CVE Software vulnerabilities
Product Software products
Vendor Software vendors
Patch Security updates
Industry Target industries
Country Threat actor origin

Relationship Types

Relationship Direction Purpose
USES ThreatGroup → Malware Uses malware
EMPLOYS ThreatGroup → Technique Uses attack technique
TARGETS ThreatGroup → Industry Targets industry
LOCATED_IN ThreatGroup → Country Country of origin
EXPLOITS Malware → CVE Exploits vulnerability
AFFECTS CVE → Product Affects product
PRODUCED_BY Product → Vendor Product vendor
FIXED_BY Patch → CVE Patch fixes vulnerability
PROTECTS Patch → Product Patch protects product

Screenshots

Graph Overview

graph-overview
graph-overview788×457 43.6 KB

(Attach graph-overview.png here)

attack-chain
attack-chain750×416 20.8 KB

vendors
vendors748×388 16.6 KB

GitHub / Demo URL

Repository: https://github.com/khanadil84/cyber-attack-knowledge-graph

Dataset URL

https://github.com/khanadil84/cyber-attack-knowledge-graph/tree/main/data

Additional Notes

What I Learned

  • Designed a cybersecurity knowledge graph using Neo4j.
  • Imported structured CSV datasets using reusable Cypher scripts.
  • Applied graph data modeling concepts to represent cybersecurity entities and their relationships.
  • Created constraints to maintain data consistency and integrity.
  • Built graph queries to analyze attack chains and software vulnerability relationships.
  • Learned practical graph modeling techniques for cybersecurity intelligence and threat analysis.
  • Improved my understanding of Neo4j graph databases, Cypher queries, and data importing workflows.

Example Queries

Threat Groups using Malware

MATCH (tg:ThreatGroup)-[:USES]->(m:Malware)
RETURN tg.name, m.name;

Complete Attack Chain

MATCH (tg:ThreatGroup)-[:USES]->(m:Malware)
      -[:EXPLOITS]->(c:CVE)
      -[:AFFECTS]->(p:Product)
RETURN tg,m,c,p;

Products and Vendors

MATCH (p:Product)-[:PRODUCED_BY]->(v:Vendor)
RETURN p.name, v.name;