Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

On Technique Identification and Threat-Actor Attribution using LLMs and Embedding Models

T0 review · 4 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that off-the-shelf LLM and embedding tools can extract TTPs noisy enough to train an above-chance threat-actor attribution model, with the best model ranking the true actor 7.55th on average out of 29.

desk verdict Useful, reproducible pipeline but the headline claim overstates: the 7.55 rank attribution result is for VE-search TTPs only, not the GPT-4 TTPs the abstract credits. read the letter →

arxiv 2505.11547 v1 pith:DOD6QRV6 submitted 2025-05-15 cs.CR cs.AIcs.CY

Kyla Guru , Robert J. Moss , Mykel J. Kochenderfer This is my paper · ORCID
classification cs.CRcs.AIcs.CY
keywords cyberthreatattributionlargelanguagemodelsTTPextractionvectorembeddingsMITREATT&CKactorprofilingBayesianclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether off-the-shelf LLMs and embedding models can replace manual TTP extraction in cyber-attack attribution. It compares LLM-generated TTPs and embedding-search TTPs to human-labeled MITRE ATT&CK data, finding low per-actor Jaccard similarity (GPT-4 around 0.39, embedding search around 0.18) even though GPT-4's TTP frequency distribution tracks MITRE's with $R^2=0.81$. Using vector-embedding search over raw reports to build per-actor TTP profiles, the resulting model attributes held-out documents with an average rank of 7.55 out of 29 threat actors, versus a random baseline mean of 15. The authors conclude that such pipelines are not ready to automate attribution but could serve as decision-support for analysts.

What carries the argument

The load-bearing object is the TTP (tactic, technique, procedure), MITRE ATT&CK's behavioral indicator vocabulary, with each threat actor represented as a probability vector over TTPs. TTP identification has two routes: prompting GPT-4 to output a comma-separated list of technique IDs, or vector-embedding search in which each document is split into 3-line chunks, each chunk and each TTP definition is embedded with text-embedding-3-large, and the chunk is assigned the TTP with maximum cosine similarity; the HyDE variant replaces bare definitions with hypothetical document embeddings. Attribution then normalizes the TTP counts of a new document into $\bar{y}$, multiplies by a weight matrix $\tilde{Y}$ whose rows are per-actor normalized TTP probabilities learned from training reports, and applies Bayes' theorem with either a uniform or empirically fit expert prior to produce a ranked list. This machinery converts raw forensic text into a ranked attribution without any manual label extraction.

What would settle it

Compute the maximum pairwise embedding similarity or n-gram overlap between each test document and all training documents; if near-duplicate pairs exist, remove them and rerun the 70/20/10 protocol. If the average rank then degrades toward the random baseline of 15, the reported 7.55 is inflated by memorization rather than generalization.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that the noise in LLM-generated TTPs is not random: even though both GPT-4 prompting and vector-embedding search produce sets with low Jaccard similarity to human-generated MITRE labels, GPT-4's per-TTP frequencies track MITRE's frequencies with $R^2=0.81$, and the probabilistic TTP profiles built from embedding search train a model that ranks the correct threat actor 7.55th on average among 29 candidates, above the random baseline mean of 15. The authors read this as evidence that behavioral TTP extraction from raw reports retains enough signal for decision support, with the largest gains for actors with distinctive, low-entropy TTP profiles and notable failures for high-entropy actors such as Lazarus Group and menuPass.

Load-bearing premise

The 70/20/10 document split assumes reports about the same threat actor in the test set are not near-duplicates of training reports, and the paper does not describe deduplication or overlap checks before adding external reports for 12 actors.

Editorial extensions

If this is right

  • An end-to-end attribution pipeline can be assembled from raw CTI reports and off-the-shelf models, reaching an average rank of 7.55 out of 29 threat actors on held-out documents.
  • The same architecture can rank candidates as a triage aid for analysts, while flagging actors such as Lazarus Group and menuPass as hard to distinguish.
  • Because GPT-4's TTP output is noisy but frequency-aligned with MITRE, LLM-generated TTP sets are best used to supplement, not replace, human-annotated profiles.
  • Giving a threat actor more source documents improves downstream attribution rank, so the pipeline's value grows as the reference corpus expands.
  • A probabilistic, normalized TTP weight matrix provides more granular information to analysts than MITRE's binary presence/absence profiles.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A clean testable extension is to rerun the pipeline on reports published after GPT-4's training cutoff; if the $R^2=0.81$ frequency correlation persists, it reflects behavioral regularity rather than memorization of MITRE data.
  • The high-entropy failure pattern suggests an abstention rule: when the predicted TTP profile has entropy above a learned threshold, the model should return 'insufficient evidence' rather than a ranked list.
  • The same embedding-search mechanism could be adapted to other behavioral vocabularies, such as ICS/OT techniques or malware API calls, by swapping the TTP definition set, since nothing in the pipeline depends on the specific MITRE taxonomy.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper evaluates two methods for extracting MITRE ATT&CK TTPs from unstructured cyber threat intelligence reports: prompting GPT-4 and a vector-embedding (VE) nearest-neighbor search over TTP definitions. The extracted TTPs are compared with MITRE's human-generated per-actor TTP sets using Jaccard similarity and frequency correlation. An attribution pipeline then constructs normalized per-actor TTP weight matrices from VE-extracted TTPs and ranks threat actors for held-out documents by a dot product (Algorithm 2). The best reported average rank is 7.55 out of 29 actors with HyDE augmentation and an expert prior, compared with a random-guess baseline mean of 15. The abstract and conclusion claim that LLM-generated TTPs, despite their divergence from human-generated sets, are useful for training a model that performs above baseline on attribution.

Significance. The paper's main strength is a concrete, reproducible end-to-end pipeline with publicly linked code, and the VE-based attribution result could constitute a useful decision-support proof-of-concept if it survives stronger baselines and a leakage-free evaluation. The frequency-correlation result (R^2=0.81) is interesting but is not evidence for the attribution claim, and the manuscript itself concedes that GPT-4 may have memorized the MITRE data. The central advertised contribution — that LLM-generated TTPs enable above-baseline attribution — is not supported by the reported experiments, which use only VE-search TTPs in the attribution pipeline.

major comments (4)
  1. [IV.B.1; Table I] The attribution experiments in Section IV.B and Table I use only TTPs produced by the vector-embedding search: Section IV.B.1 states that 'The vector embedding search approach is used for all documents in the training dataset to generate Y_ttp,' and Table I reports no condition in which GPT-4-generated TTPs are used either in the weight matrix or in the test documents. The abstract's and conclusion's claim that LLM-generated TTPs 'still prove useful for training a model that performs above baseline on attribution' is therefore not supported by any experiment in the manuscript. Since Algorithm 2 is agnostic to how the TTPs are generated, the missing condition is readily testable; the authors should run the attribution protocol on GPT-4 TTPs or revise the central claim to refer specifically to VE-search TTPs.
  2. [V.A] The only baseline in Table I is random guessing over the 29 actors (uniform distribution with mean 15). This baseline is too weak to establish 'above baseline' attribution: a prior-only classifier that always predicts the training-set prior, a majority-class baseline, or a model trained on the MITRE human-generated TTPs would be far more informative, particularly because the gain from the uniform-prior condition (10.68) to the expert-prior condition (7.55) suggests that the prior itself may account for much of the improvement. Additional baselines are needed to support the claim.
  3. [IV.B] The document-level 70/20/10 split is not validated for report independence. If the same or near-identical incident reports appear in both training and test splits, the per-actor TTP profiles are effectively memorized and the reported average rank of 7.55 would be inflated. The manuscript does not describe deduplication or any overlap analysis, and the external reports added for 12 actors ([33], [34]) are not checked for overlap with the MITRE references. The authors should quantify duplicate and near-duplicate overlap across splits and re-evaluate on a deduplicated split if needed.
  4. [IV.B.1; Algorithm 2] The description of the weight matrix is internally inconsistent: the normalized counts are first described as P(y_ttp|t), then the text states that after Bayes' theorem each matrix entry represents P(t|y_ttp), but Algorithm 2 computes pattr = y_bar^T Y without showing how the prior P(t) enters the computation. Since Table I reports results for 'Uniform Expert Prior' and 'Expert Expert Prior,' the exact formula used (including the application of the prior) must be specified precisely for the experiments to be reproducible.
minor comments (4)
  1. [IV.A; Eq. (10)] The Jaccard similarity formula is written as |A ∪ B| / |A ∩ B|, which cannot produce values in the claimed [0,1] range and diverges for disjoint sets; the numerator and denominator appear to be swapped. The reported values (e.g., 0.39) are consistent with the standard |A ∩ B| / |A ∪ B|, so the equation should be corrected.
  2. [IV.B.2; Table I] The text reports the uniform-prior average rank as '10.96, or 10.68,' while Table I lists 10.68 ± 0.53, and the table's 'Expert Expert Prior' label appears to be a typo for 'Expert Prior.' Please harmonize the prose and table.
  3. [Abstract; Section VII] The GitHub URL in the abstract contains a space ('https://github.com/kylag/ttp attribution') and should be 'https://github.com/kylag/ttp_attribution'; the conclusion also contains a typo, 'identfication.'
  4. [Fig. 1; Section III.A] The prompt example mixes formats: 'T1083' is listed without a sub-technique element, while 'T1588','.002' is listed with a separate sub-technique string; the notation for sub-techniques in the example should be consistent.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found; the rank-7.55 attribution result is derived from a disjoint VE-search train/test pipeline, though the LLM-TTP attribution claim is untested.

full rationale

No circular step can be exhibited from the paper's equations or citations. The attribution result in Table I is produced by a disjoint-pipeline evaluation: Algorithm 1 (VE search) extracts TTPs from 70% train documents, builds normalized weight matrices, selects the best by validation, and evaluates on a held-out 10% test set via Algorithm 2. There is no fitted parameter that is relabeled as a prediction, no self-citation carries a load-bearing assumption, and no uniqueness theorem is imported from the authors. The abstract's assertion that LLM-generated TTPs 'still prove useful for training a model that performs above baseline on attribution' is not actually tested, since Section IV.B.1 states 'The vector embedding search approach is used for all documents in the training dataset to generate Y_ttp' and no row of Table I uses GPT-4 TTPs; this is a missing-experiment/internal-consistency problem, not a circularity. Similarly, the GPT-4/MITRE similarity comparisons may be contaminated by GPT-4's pretraining corpus (Section VI.A acknowledges this possibility), but that is a benchmark-validity confound rather than an equation-level reduction of the claimed result to its own inputs.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central results rest on three fitted or hand-chosen quantities: the VE chunk size k, the 10-reference threshold for selecting the 29 threat actors, and the empirically fit expert prior. No new physical or mathematical entities are introduced. The most consequential assumption is the independence of the document split, which is not verified, and the domain assumption that MITRE labels are reliable ground truth.

free parameters (3)
  • k (line window size for VE chunking) = 3
    Section IV.A states chunks of k=3 lines were used and that a sliding window did not improve accuracy; this value was chosen from experimentation, not derived.
  • Threat-actor selection threshold = 10 references
    Section IV.B footnote 1 keeps only actors with 10 or more MITRE references, yielding 29 actors; this selection shapes all reported metrics.
  • Expert prior P(t) = empirical class frequencies in training data
    Section IV.B.1 defines an 'expert prior' fit to occurrences in the training data; the best result (7.55) uses this prior, and the paper does not ablate a prior-only ranking.
assumptions (5)
  • domain assumption MITRE ATT&CK Groups human-generated TTPs are a valid ground truth for TTP identification.
    Used throughout as the comparison set Y_ttp (Sections I and IV.A).
  • domain assumption TTPs are relatively stable behavioral indicators that support attribution.
    Section II.B argues TTPs are harder to alter than IOCs, citing prior work.
  • ad hoc to paper Cosine similarity between the embedding of a 3-line chunk and the embedding of a TTP definition identifies the TTP described in the chunk.
    Algorithm 1 defines the VE search by this argmax; no independent validation of the retrieval validity is provided.
  • domain assumption The 70/20/10 document split yields independent training and test samples.
    Section IV.B.1 describes the split but no deduplication or near-duplicate check; this is load-bearing for the attribution ranking.
  • standard math Bayes' theorem with an empirically estimated prior is applicable for ranking threat actors.
    Used in Eqs. (11) and (12) to justify the unnormalized posterior comparison.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On Technique Identification and Threat-Actor Attribution using LLMs and Embedding Models." pith.science (2026). https://pith.science/paper/DOD6QRV6

@misc{pith2026250511547,
  author       = {Pith},
  title        = {Pith review of: On Technique Identification and Threat-Actor Attribution using LLMs and Embedding Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DOD6QRV6}},
  note         = {Machine review of arXiv:2505.11547}
}
read the original abstract

Attribution of cyber-attacks remains a complex but critical challenge for cyber defenders. Currently, manual extraction of behavioral indicators from dense forensic documentation causes significant attribution delays, especially following major incidents at the international scale. This research evaluates large language models (LLMs) for cyber-attack attribution based on behavioral indicators extracted from forensic documentation. We test OpenAI's GPT-4 and text-embedding-3-large for identifying threat actors' tactics, techniques, and procedures (TTPs) by comparing LLM-generated TTPs against human-generated data from MITRE ATT&CK Groups. Our framework then identifies TTPs from text using vector embedding search and builds profiles to attribute new attacks for a machine learning model to learn. Key contributions include: (1) assessing off-the-shelf LLMs for TTP extraction and attribution, and (2) developing an end-to-end pipeline from raw CTI documents to threat-actor prediction. This research finds that standard LLMs generate TTP datasets with noise, resulting in a low similarity to human-generated datasets. However, the TTPs generated are similar in frequency to those within the existing MITRE datasets. Additionally, although these TTPs are different than human-generated datasets, our work demonstrates that they still prove useful for training a model that performs above baseline on attribution. Project code and files are contained here: https://github.com/kylag/ttp_attribution.

Figures

Figures reproduced from arXiv: 2505.11547 by the authors.

Figure 1
Figure 1. GPT prompt used to predict TTPs from an attached document. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Testing split using unseen 10% of total documentation. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. TTP frequencies from MITRE and GPT-4 generated datasets. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Comparing Jaccard similarity for the exhaustive baseline, the vector embeddings (VE), and GPT-4. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. AURA: A Multi-Agent Intelligence Framework for Knowledge-Enhanced Cyber Threat Attribution

    cs.CR 2025-06 conditional novelty 6.0 of 10

    AURA combines retrieval-augmented agents and large language models to attribute APT campaigns to threat groups and nations, with natural language justifications.

Reference graph

Works this paper leans on

40 extracted references · 35 canonical work pages · cited by 1 Pith paper

  1. [33]

    etda.or.th/cgi-bin/aptgroups.cgi, 2024

    Advanced Persistent Threat (APT) Groups , https://apt. etda.or.th/cgi-bin/aptgroups.cgi, 2024

    work page 2024

  2. [34]

    Mazuz, Attack Attribution Dataset , https : / / github

    E. Mazuz, Attack Attribution Dataset , https : / / github. com/eyalmazuz/AttackAttributionDataset, 2024

    work page 2024

  3. [1]

    Soesanto, Divided or United in Cyberspace? From EU, NATO, Five Eyes to Japan , https : / / media

    S. Soesanto, Divided or United in Cyberspace? From EU, NATO, Five Eyes to Japan , https : / / media . realinstitutoelcano.org/wp- content/uploads/2021/10/ wp11-2021-soesanto-the-19th-july-divided-or-united- in - cyberspace - from - eu - nato - five - eyes - japan . pdf, Accessed: 2023-12-20, Oct. 2021

    work page 2021

  4. [2]

    Cyber Threat Attri- bution Using Unstructured Reports in Cyber Threat Intelligence,

    E. Irshad and A. B. Siddiqui, “Cyber Threat Attri- bution Using Unstructured Reports in Cyber Threat Intelligence,” Egyptian Informatics Journal , vol. 24, no. 1, pp. 43–59, 2023, Accessed: 2023-12-10. [Online]. Available: https://doi.org/10.1016/j.eij.2022.11.001

    work page doi:10.1016/j.eij.2022.11.001 2023

  5. [3]

    Explainable APT Attribution for Malware Using NLP Techniques,

    Q. Wang, H. Yan, and Z. Han, “Explainable APT Attribution for Malware Using NLP Techniques,” in 2021 IEEE 21st International Conference on Software Quality, Reliability and Security (QRS) , Accessed De- cember 9, 2023, Hainan, China, 2021, pp. 70–80

    work page 2021

  6. [4]

    Auto- matically Labeling Cyber Threat Intelligence Reports Using Natural Language Processing,

    H. Abdi, S. Bagley, S. Furnell, and J. Twycross, “Auto- matically Labeling Cyber Threat Intelligence Reports Using Natural Language Processing,” in Proceedings of ACM Symposium on Document Engineering 2023 (DocEng ’23), Accessed December 10, 2023, Limerick, Ireland: ACM, 2023, 4 pages. [Online]. Available: https: //doi.org/10.1145/3573128.3609348

    work page arXiv 2023

  7. [5]

    NO-DOUBT: At- tack Attribution Based On Threat Intelligence Reports,

    L. Perry, B. Shapira, and R. Puzis, “NO-DOUBT: At- tack Attribution Based On Threat Intelligence Reports,” in 2019 IEEE International Conference on Intelligence and Security Informatics (ISI) , Accessed December 10, 2023, Shenzhen, China, 2019, pp. 80–85. [Online]. Available: https://doi.org/10.1109/ISI.2019.8823152

    work page arXiv 2019

  8. [6]

    Deep Learning for Threat Actor Attribution from Threat Reports,

    S. Naveen, R. Puzis, and K. Angappan, “Deep Learning for Threat Actor Attribution from Threat Reports,” in 2020 4th International Conference on Computer, Com- munication and Signal Processing (ICCCSP), Accessed December 10, 2023, Chennai, India, 2020, pp. 1–6. [On- line]. Available: https://doi.org/10.1109/ICCCSP49186. 2020.9315219

    work page arXiv 2020

Show all 40 references
  1. [7]

    Cyber Threat Attri- bution Using Unstructured Reports in Cyber Threat Intelligence,

    E. Irshad and A. B. Siddiqui, “Cyber Threat Attri- bution Using Unstructured Reports in Cyber Threat Intelligence,” Egyptian Informatics Journal , vol. 24, no. 1, pp. 43–59, 2023, Accessed December 10, 2023. [Online]. Available: https://doi.org/10.1016/j.eij.2022. 11.001

    2023 doi

  2. [8]

    At- tribution classification method of apt malware based on multi-feature fusion,

    Y . Zhang, H. Zhang, L. Zhang, and Z. Zhang, “At- tribution classification method of apt malware based on multi-feature fusion,” PLOS ONE , vol. 19, no. 6, e0305006, 2024, ISSN : 1932-6203. [Online]. Available: https://journals.plos.org/plosone/article?id=10.1371/ journal.pone.0305006

    2024

  3. [10]

    MITRE, Groups, https : / / attack . mitre . org / groups/, Accessed May 19, 2024, 2024

    2024

  4. [11]

    Misleading Au- thorship Attribution of Source Code Using Adversarial Learning,

    E. Quiring, A. Maier, and K. Rieck, “Misleading Au- thorship Attribution of Source Code Using Adversarial Learning,” in Proceedings of the 28th USENIX Secu- rity Symposium , Accessed December 11, 2023, 2019, pp. 479–496

    2023

  5. [12]

    Nation-State Threat Ac- tor Attribution Using Fuzzy Hashing,

    M. Kida and O. Olukoya, “Nation-State Threat Ac- tor Attribution Using Fuzzy Hashing,” IEEE Access , vol. 11, pp. 1148–1165, 2023, Accessed December 10,

    2023

  6. [13]

    CrowdStrike, Advanced Persistent Threat (APT) , https: //www.crowdstrike.com/cybersecurity- 101/advanced- persistent-threat-apt/, Accessed: 2023-12-10

    2023

  7. [14]

    A Comprehensive Survey of Advanced Persistent Threat Attribution: Tax- onomy, Methods, Challenges and Open Research Prob- lems,

    Y . Xu, J. Tao, Z. Liu, and Y . Shen, “A Comprehensive Survey of Advanced Persistent Threat Attribution: Tax- onomy, Methods, Challenges and Open Research Prob- lems,” arXiv preprint arXiv:2409.11415 , 2024. arXiv: 2409 . 11415 [cs.CR]. [Online]. Available: https : / / arxiv.o...

    2024 arXiv

  8. [15]

    Vulcan: Automatic ex- traction and analysis of cyber threat intelligence from unstructured text,

    H. Jo, Y . Lee, and S. Shin, “Vulcan: Automatic ex- traction and analysis of cyber threat intelligence from unstructured text,” Computers & Security , vol. 120, p. 102 763, 2022

    2022

  9. [16]

    Automated discovery and mapping att&ck tactics and techniques for unstruc- tured cyber threat intelligence,

    L. Li, C. Huang, and J. Chen, “Automated discovery and mapping att&ck tactics and techniques for unstruc- tured cyber threat intelligence,” Computers & Security , vol. 140, p. 103 815, 2024, ISSN : 0167-4048. [Online]. Available: https : / / www . sciencedirect . com / science...

    2024

  10. [17]

    CTI: Attributing Cyberattacks,

    I. Magazine, “CTI: Attributing Cyberattacks,” Infosecu- rity Magazine , 2024, Accessed: 2024-05-18. [Online]. Available: https : / / www. infosecurity - magazine . com / news-features/cti-attributing-cyberattacks/

    2024

  11. [18]

    A Machine Learning Based Empirical Evaluation of Cyber Threat Actors’ High Level Attack Patterns over Low Level Attack Patterns in Attributing Attacks,

    U. Noor, S. Shahid, R. Kanwal, and Z. Rashid, “A Machine Learning Based Empirical Evaluation of Cyber Threat Actors’ High Level Attack Patterns over Low Level Attack Patterns in Attributing Attacks,” arXiv preprint arXiv:2307.10252 , Jul. 2023, Accessed De- cember 10, 2023. [O...

    2023 arXiv

  12. [19]

    On the Feasibility of Malware Authorship Attribution,

    S. Alrabaee, P. Shirani, M. Debbabi, and L. Wang, “On the Feasibility of Malware Authorship Attribution,” in Proceedings of the International Symposium on Founda- tions and Practice of Security , Accessed December 10, 2023, Cham, Switzerland: Springer, 2016, pp. 256–272

    2023

  13. [20]

    Iden- tifying Authorship Style in Malicious Binaries: Techniques, Challenges & Datasets,

    J. Gray, D. Sgandurra, and L. Cavallaro, “Iden- tifying Authorship Style in Malicious Binaries: Techniques, Challenges & Datasets,” arXiv preprint arXiv:2101.06124, Jan. 2021, Accessed December 10,

    2021 arXiv

  14. [21]

    Bianco, The Pyramid of Pain , http://detect-respond

    D. Bianco, The Pyramid of Pain , http://detect-respond. blogspot . com / 2013 / 03 / the - pyramid - of - pain . html, Accessed November 3, 2023, 2013

    2013

  15. [22]

    DeepSign: Deep Learning for Automatic Malware Signature Generation and Classification,

    O. E. David and N. S. Netanyahu, “DeepSign: Deep Learning for Automatic Malware Signature Generation and Classification,” in Proceedings of the International Joint Conference on Neural Networks (IJCNN) , Ac- cessed December 10, 2023, Killarney, Ireland, Jul. 2015, pp. 1–8

    2023

  16. [23]

    Available: https://arxiv.org/abs/2101

    [Online]. Available: https://arxiv.org/abs/2101. 06124

  17. [24]

    Automated Behavioral Analysis of Malware: A Case Study of WannaCry Ransomware,

    Q. Chen and R. A. Bridges, “Automated Behavioral Analysis of Malware: A Case Study of WannaCry Ransomware,” in Proceedings of the 16th IEEE Inter- national Conference on Machine Learning and Appli- cations (ICMLA) , Accessed December 10, 2023, Dec. 2017, pp. 454–460

    2023

  18. [25]

    DeepAPT: Nation-State Apt Attribution Using End-to-End Deep Neural Networks,

    I. Rosenberg, G. Sicard, and E. ( David, “DeepAPT: Nation-State Apt Attribution Using End-to-End Deep Neural Networks,” in Advances in Neural Networks , Accessed: 2024-05-18, SpringerLink, 1970. [Online]. Available: https://link.springer.com/chapter/10.1007/ 978-3-319-68612-7 11

    2024

  19. [26]

    Dynamic Malware Analysis Using Cuckoo Sandbox,

    S. Jamalpur, Y . S. Navya, P. Raja, G. Tagore, and G. R. K. Rao, “Dynamic Malware Analysis Using Cuckoo Sandbox,” in Proceedings of the 2nd Inter- national Conference on Inventive Communication and Computational Technologies (ICICCT) , Accessed De- cember 10, 2023, Apr. 2018, ...

    2023

  20. [27]

    APTMalware GitHub Repository , https://github.com/ cyber-research/APTMalware, Accessed November 23, 2023, 2023

    2023

  21. [28]

    MTEB: Massive text embedding benchmark,

    N. Muennighoff, N. Tazi, L. Magne, and N. Reimers, “MTEB: Massive text embedding benchmark,” in Pro- ceedings of the 17th Conference of the European Chap- ter of the Association for Computational Linguistics , A. Vlachos and I. Augenstein, Eds., Dubrovnik, Croa- tia: Associati...

    2023

  22. [29]

    Win- dows Malware Detection Based on Cuckoo Sandbox Generated Report Using Machine Learning Algorithm,

    S. Shiva Darshan, M. A. Ajay, and C. Jaidhar, “Win- dows Malware Detection Based on Cuckoo Sandbox Generated Report Using Machine Learning Algorithm,” in Proceedings of the 2016 11th International Con- ference on Industrial and Information Systems (ICIIS) , Dec. 2016, pp. 534–539

    2016

  23. [30]

    Precise zero-shot dense retrieval with- out relevance labels,

    L. Gao et al. , “Precise zero-shot dense retrieval with- out relevance labels,” arXiv preprint arXiv:2212.10496, 2022

    2022 arXiv

  24. [31]

    C. D. Manning, P. Raghavan, and H. Sch ¨utze, In- troduction to Information Retrieval . Cambridge, UK: Cambridge University Press, 2008

    2008

  25. [32]

    org/techniques/enterprise/, Accessed: 2023-12-10

    MITRE, Techniques - Enterprise , https://attack.mitre. org/techniques/enterprise/, Accessed: 2023-12-10

    2023

  26. [35]

    [Online]

    MITRE ATT&CK, T1087.001: Account discovery: Lo- cal account , Accessed: 2024-07-07, 2024. [Online]. Available: https://attack.mitre.org/techniques/T1087/ 001/

    2024

  27. [36]

    MITRE ATT&CK, Technique t1064: Scripting, MITRE,

  28. [37]

    [Online]

    MITRE ATT&CK, Technique t1059: Command and scripting interpreter , MITRE, 2023. [Online]. Avail- able: https://attack.mitre.org/techniques/T1059/

    2023

  29. [38]

    Brownlee, K-Fold Cross-Validation , https : / / machinelearningmastery.com/k- fold- cross- validation/, 2024

    J. Brownlee, K-Fold Cross-Validation , https : / / machinelearningmastery.com/k- fold- cross- validation/, 2024

    2024

  30. [40]

    Available: https : / / attack

    [Online]. Available: https : / / attack . mitre . org / techniques/T1064/

  31. [2023]

    Available: https : / / doi

    [Online]. Available: https : / / doi . org / 10 . 1109 / ACCESS.2022.3233403

    2022

  32. [2025]

    04040 [cs]

    arXiv: 2501 . 04040 [cs]. [Online]. Available: https://arxiv.org/abs/2501.04040

    arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.