Virual Oral Presentation Slide by Slide

IEEE/ICACT20220038 Slide.11        [Big Slide]	Oral Presentation
	Field information in detection rule is meaningful. Take "Suricata NIDS" as an example, we observed that threat description in message field was meaningful and those information could be related to the description of TTP in MITRE ATT&CK framework. Also, the type of attack in "classtype" field and additional information in metadata was helpful for tactic labeling because they provided the attack targets or CVE which give good reference to label the tactic of detection rules. According to the observation, we used this characteristic to label the detection rule tactic. However, we met a challenge because of few public TTP-labeled datasets for Suricata rules. The lack of labeled dataset will make tactic labeling work by Machine Learning ineffective, so we propose a mechanism for attack tactic labeling. ​

[Go to Next Slide]

Select Voice: Virtual Oral Presentation!!