 |
To accelerate the efficiency and accuracy of the labeling process, matching rules are developed by information security experts for tactic labeling. Since some specific keywords or information such as protocol, threat type, and malware family can be directly used to determine the tactic group of the Suricata rule, experts define keywords for each tactic group. For example, the "remote code execution" and "Zerologon" can be labeled as "lateral movement" tactic, and the terms related to OWASP Top 10 vulnerabilities can be labeled as "initial-access" tactic. |
IEEE/ICACT20220038 Slide.14
[Big Slide]
[YouTube]