 |
To label tactic, we propose an "Attack Tactic Labeling" mechanism. The mechanism mainly consists of two parts. The first part is similarity-based tactic labeling, which aims to efficiently assist experts with tactic labeling and accumulate the dataset quickly. The second part is machine learning-based tactic labeling, learning features of different tactics from the expanded dataset.
กก
First step is "TTP Labeling by experts". Before similarity-based tactic labeling, we need the labeled dataset as the training dataset, but experts labeling makes time-consuming and labor-intensive. Therefore, the next stage "Similarity-based Tactic Labeling" labels the Tactic for numerous Suricata rules and it can expand the training dataset. The third step is "TTP Result Validation by experts". We have to ensure training dataset is reliable, so the labeled result needs to be validated in this step. The "Machine Learning-based Tactic Labeling" is the final step. We train the expanded dataset as a model by machine learning algorithms and label the subsequent detection rules by trained model. Finally, there is a feedback mechanism for continuously enhancing the accuracy of tactic labeling. |
IEEE/ICACT20220038 Slide.12
[Big Slide]