 |
We choose "Pearson Correlation Coefficient", which obtain the best score in the experiment results of different similarity algorithms, as the primary method. We observe that the overall results of the malware-related category, such as "malware-cnc" and "malware-other", are better than the other categories. We then further analyze the reasons and discover that the categories with better results are because the texts in the "msg" field have a higher overlap with the texts in tactic articles. For example, the "download" term and "backdoor" term appeared in the malware-related category are the keyword in the "Command and Control" tactic and the "Persistence" tactic, respectively. However, the terms in the "server-webapp" category are mainly presented as the "OWASP Top 10" term for web-related attacks, with very few attack-related technique terms. Therefore, they have a lower overlap with the terms in the tactic articles, which is the main reason for the poor results. |
IEEE/ICACT20220038 Slide.25
[Big Slide]