论文标题
自动检索ATT＆CK策略和网络威胁报告的技术
Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports
论文作者
论文摘要
在过去的几年中，威胁情报共享稳步增长，导致网络安全专业人员访问越来越多的异质数据。其中，网络攻击的策略，技术和程序（TTP）已被证明在表征威胁参与者的行为并因此改善防御性对策时特别有价值。不幸的是，这些信息通常隐藏在人类可读的文本报告中，必须手动提取。在本文中，我们评估了几种分类方法，可以自动从非结构化文本中检索TTP。为了实施这些方法，我们利用了MITER ATT＆CK框架，这是对抗性策略和技术的开放知识基础，以培训分类器和标签结果。最后，我们提出了RCATT，这是一种基于我们发现的工具，并自由分发给安全社区，以支持网络威胁报告自动分析。
Over the last years, threat intelligence sharing has steadily grown, leading cybersecurity professionals to access increasingly larger amounts of heterogeneous data. Among those, cyber attacks' Tactics, Techniques and Procedures (TTPs) have proven to be particularly valuable to characterize threat actors' behaviors and, thus, improve defensive countermeasures. Unfortunately, this information is often hidden within human-readable textual reports and must be extracted manually. In this paper, we evaluate several classification approaches to automatically retrieve TTPs from unstructured text. To implement these approaches, we take advantage of the MITRE ATT&CK framework, an open knowledge base of adversarial tactics and techniques, to train classifiers and label results. Finally, we present rcATT, a tool built on top of our findings and freely distributed to the security community to support cyber threat report automated analysis.
