A two-stage fine-tuning approach that augments rare attack-technique classes with similar MITRE descriptions improves Macro-F1 by 5 to 9 points on the TRAM benchmark.
Towards Automated Classification of Attackers' TTPs by combining NLP with ML Techniques
1 Pith paper cite this work. Polarity classification is still indexing.
1
Pith paper citing it
abstract
The increasingly sophisticated and growing number of threat actors along with the sheer speed at which cyber attacks unfold, make timely identification of attacks imperative to an organisations' security. Consequently, persons responsible for security employ a large variety of information sources concerning emerging attacks, attackers' course of actions or indicators of compromise. However, a vast amount of the needed security information is available in unstructured textual form, which complicates the automated and timely extraction of attackers' Tactics, Techniques and Procedures (TTPs). In order to address this problem we systematically evaluate and compare different Natural Language Processing (NLP) and machine learning techniques used for security information extraction in research. Based on our investigations we propose a data processing pipeline that automatically classifies unstructured text according to attackers' tactics and techniques derived from a knowledge base of adversary tactics, techniques and procedures.
fields
cs.LG 1years
2024 1verdicts
CONDITIONAL 1representative citing papers
citing papers explorer
-
Cyber-Attack Technique Classification Using Two-Stage Trained Large Language Models
A two-stage fine-tuning approach that augments rare attack-technique classes with similar MITRE descriptions improves Macro-F1 by 5 to 9 points on the TRAM benchmark.