IEEE/ICACT20220038 Slide.17        [Big Slide]       Oral Presentation
With the help of "Similarity-based Labeling," the labeled dataset can be expanded efficiently. Next, we aim to learn the features of each tactic to improve the accuracy of labeling through machine learning algorithms. Machine learning can be effective for subsequent prediction only when the dataset is sufficient. Thus, we use the large labeling dataset extended by Similarity-based Labeling part to train models for tactic classification in Machine Learning-based Tactic Labeling part. The architecture of "Machine Learning-based Tactic Labeling" is shown in the figure. First, the labeled Suricata rule dataset is vectorized by the TF-IDF Vectorizer. Next, the attack tactic learning module trains the model with specified supervised learning algorithms. Finally, the rules that need to be labeled are vectorized into features and then predicted the tactic group with the model.​

[Go to Next Slide]
Select Voice: