ICACT20220038 Question.1
Questioner: zakaria.sawado@gmail.com 2022-02-14 오후 9:00:29 |
ICACT20220038 Answer.1
Answer by Auhor dongjiewu@iii.org.tw 2022-02-14 오후 9:00:29
Chrome  Click!! |
| You had given limits of some works but in your proposal I do not see that these limits have been taken into account. |
This issue is mentioned in our contributions and benchmarks. To overcome these limitations, we used the textual description of the rule content as training data. Although a rule contains less information available for training, it still achieves a high accuracy rate. In this way, our mechanism can be applied not only at the network level, but also further to different levels of security applications. In addition, we have a feedback mechanism to improve the accuracy of the TTP labels. |
ICACT20220038 Question.2
Questioner: tomayoon@ieee.org 2022-02-14 오후 5:10:29 |
ICACT20220038 Answer.2
Answer by Auhor dongjiewu@iii.org.tw 2022-02-14 오후 5:10:29
Chrome Click!! |
| First of all, thank you for the good research paper and presentation contents. I would like to know more about the research environment used in this study, and also in detail about the equipment & operating systems, development languages and software libraries you used. |
We use a PC with 16G RAM. The Operating System is Ubuntu 18.04. The development language is python 3.6.9. The python library we use is SKLearn for similarity-based labeling and Machine Learning based labeling. |
ICACT20220038 Question.3
Questioner: bojsahsupeng@iii.org.tw 2022-02-15 오전 10:41:27 |
ICACT20220038 Answer.3
Answer by Auhor dongjiewu@iii.org.tw 2022-02-15 오전 10:41:27
Chrome Click!! |
| Your contribution mentions that the mechanism can apply various security applications. The labeling target in your experiment is "Suricata". Does your mechanism only apply for network security applications? |
If the detection rule contains meaningful and readable information which can be to the description of TTP, our mechanism could label TTP for it because of its information. Therefore, our mechanism can apply for not only network security applications but also host-based security applications such as HIDS, yara rule, firewall logs, etc. |
ICACT20220038 Question.4
Questioner: mryoulin@gmail.com 2022-02-16 오후 6:50:42 |
ICACT20220038 Answer.4
Answer by Auhor dongjiewu@iii.org.tw 2022-02-16 오후 6:50:42
Chrome Click!! |
| Your proposed "Attack Tactic Labeling"mechanism consists of the two parts "similarity-based tactic labeling" and the machine learning-based tactic labeling". Could you describe their differences and the originalities ? |
|
