 |
After TF-IDF Vectorizer calculates the respective feature vectors for MITRE articles of each tactic and the ¡°msg¡± field in Suricata rules, we use different similarity algorithms (including Cosine Similarity, Pearson Correlation Coefficient, and Euclidean Distance) to label the tactic of the detection rule.
¡¡
The cosine similarity is evaluated by calculating the angle between two vectors in space; when the angle between the two vectors is smaller, the cosine value tends to 1, reaching the maximum value of 1 at 0 degrees.
¡¡
The Pearson correlation coefficient subtracts an average calculated from the vectors in all dimensions and then computes the cosine similarity. The result for the Pearson correlation coefficient has been proved to accord with the actual condition while keeping the original characteristics.
¡¡
Euclidean distance is a common method in geometry to calculate the linear distance between two points. |
IEEE/ICACT20220038 Slide.16
[Big Slide]