 |
The third study developed an automatic TTP labeling tool for cyber threat reports named rcATT. The TTP labeling tool aimed to help cyber security experts easily obtain threat actions from threat reports. They used three weighting scheme, such as TF, TF-IDF, Word2Vec, to determine the weight of each term, and Binary Relevance, Classifier Chain, Bernoulli Naive Bayes classifier, KNN for TTP labeling. Their method is limited when handling data with little information.
กก
The fourth paper proposed a tool, called TTPDrill, which can automatically and accurately extract threat actions from unstructured text of CTI sources. They also develop automated context-aware analytics of cyber threat intelligence, which can assist experts in mapping threat actions to attack patterns (TTPs). They also used TF-IDF to determine the weight of each term, and BM25 for TTP labeling. However, TTPDrill is lack of user feedback mechanism, which makes continuous improvement more difficult. |
IEEE/ICACT20220038 Slide.09
[Big Slide]