论文标题
通过将NLP与ML技术相结合，以对攻击者的TTP进行自动分类
Towards Automated Classification of Attackers' TTPs by combining NLP with ML Techniques
论文作者
论文摘要
越来越复杂的威胁参与者以及网络攻击不断发展的速度越来越大，及时确定对组织的安全必须确定攻击。因此，负责安全人员的人员采用了有关新兴攻击，攻击者的行动或妥协指标的各种信息来源。但是，大量所需的安全信息以非结构化的文本形式获得，这使自动化和及时提取攻击者的策略，技术和程序（TTPS）复杂化。为了解决这个问题，我们系统地评估和比较了用于安全信息提取的研究中不同的自然语言处理（NLP）和机器学习技术。根据我们的调查，我们提出了一条数据处理管道，该管道会根据攻击者的策略和技术自动对非结构化文本进行分类，这些策略和技术从对手策略，技术和程序的知识库中得出。
The increasingly sophisticated and growing number of threat actors along with the sheer speed at which cyber attacks unfold, make timely identification of attacks imperative to an organisations' security. Consequently, persons responsible for security employ a large variety of information sources concerning emerging attacks, attackers' course of actions or indicators of compromise. However, a vast amount of the needed security information is available in unstructured textual form, which complicates the automated and timely extraction of attackers' Tactics, Techniques and Procedures (TTPs). In order to address this problem we systematically evaluate and compare different Natural Language Processing (NLP) and machine learning techniques used for security information extraction in research. Based on our investigations we propose a data processing pipeline that automatically classifies unstructured text according to attackers' tactics and techniques derived from a knowledge base of adversary tactics, techniques and procedures.
