 |
In the beginning, we regard tactic labeling for Suricata rules as an information retrieval problem because of the limited dataset. We consider the description of the "msg" field in Suricata rules as the text to be queried and compare them with matching rules defined by experts in the "Keywords for Tactic Matching" function. If no matching rules can be met, the Suricata rule to be labeled will then be passed to the TF-IDF Vectorizer in the similarity-based labeling phase. Afterward, the vectorizer calculates the importance of terms in each tactic through TF-IDF algorithm. Finally, according to the similarity between the Suricata rule and each tactic group, the tactic group with the highest similarity is taken as the labeling result. |
IEEE/ICACT20220038 Slide.13
[Big Slide]