 |
In short, TTP labeling of attack detection rules is essential for further alert correlation and cyber threat hunting.
However, with the rapid changes of attack techniques, there is no systematic and continuous labeling mechanism for the detection rules.
It would be difficult to identify new types of attacks, and there will be breakpoints in the hackers¡¯ footprints.
Therefore, we aim to develop a TTP Labeling mechanism for cyber threat hunting and, importantly, to be systematic and continuous.
To achieve this goal, we will face a number of challenges, including
Only few public labeled rulesets, and
The information of the rules to be labeled is quite limit
This makes it difficult for machine learning algorithms to have sufficient information and datasets for learning. |
IEEE/ICACT20220038 Slide.05
[Big Slide]