TIM: threat context-enhanced TTP intelligence mining on unstructured threat data

Abstract

TTPs (Tactics, Techniques, and Procedures), which represent an attacker’s goals and methods, are the long period and essential feature of the attacker. Defenders can use TTP intelligence to perform the penetration test and compensate for defense deficiency. However, most TTP intelligence is described in unstructured threat data, such as APT analysis reports. Manually converting natural language TTPs descriptions to standard TTP names, such as ATT&CK TTP names and IDs, is time-consuming and requires deep expertise. In this paper, we define the TTP classification task as a sentence classification task. We annotate a new sentence-level TTP dataset with 6 categories and 6061 TTP descriptions from 10761 security analysis reports. We construct a threat context-enhanced TTP intelligence mining (TIM) framework to mine TTP intelligence from unstructured threat data. The TIM framework uses TCENet (Threat Context Enhanced Network) to find and classify TTP descriptions, which we define as three continuous sentences, from textual data. Meanwhile, we use the element features of TTP in the descriptions to enhance the TTPs classification accuracy of TCENet. The evaluation result shows that the average classification accuracy of our proposed method on the 6 TTP categories reaches 0.941. The evaluation results also show that adding TTP element features can improve our classification accuracy compared to using only text features. TCENet also achieved the best results compared to the previous document-level TTP classification works and other popular text classification methods, even in the case of few-shot training samples. Finally, the TIM framework organizes TTP descriptions and TTP elements into STIX 2.1 format as final TTP intelligence for sharing the long-period and essential attack behavior characteristics of attackers. In addition, we transform TTP intelligence into sigma detection rules for attack behavior detection. Such TTP intelligence and rules can help defenders deploy long-term effective threat detection and perform more realistic attack simulations to strengthen defense.

Comparative Experiment on TTP Classification with Class Imbalance Using Oversampling from CTI Dataset

“…You et al [5] proposed a TTP intelligence mining model that extracts and classifies TTP information from unstructured CTI reports. For this model, Sentence-BERT embeddings were used in the feature extraction step, and a twodimensional convolutional neural network and bidirectional long short-term memory network were used as classifiers, and a high F1 score of 0.97 was obtained.…”

“…is is because extracting TTP information from CTI data, which are often in the form of a report, is cost-sensitive and time-consuming because CTI reports, such as the advanced persistent threat (APT) report, are unstructured threat data provided in sentence form. Manually converting these explanatory TTP sentences into the TTP naming or ID format of the ATT&CK structure is time-consuming and requires strong expertise [5]. To address these problems, there have been several efforts since 2018 to identify (extract) TTP information from CTI reports or to automatically classify the tactics and techniques in TTP.…”

Modelo De Classificação De TTP Baseado Em Transformadas Bert

“…Uma das maiores dificuldades no uso de NLP no domínio cibernético é a pouca disponibilidade de bases de dados consistentes e anotadas (Tikhomirov, et al, 2020). Conjuntos de dados relacionados a TTPs são ainda mais raros e essa escassez dificulta o avanço de pesquisas em classificação de TTPs (You, et al, 2022) (Riera, et al, 2022). A despeito da importância, ainda há pouca pesquisa voltada ao problema da extração de TTPs de textos não estruturados (Rahman, et al, 2020).…”

“…A pesquisa de Ayoade et al (2018), por sua vez, emprega métodos de correção de viés, de propagação de confiança e de estimativa de importância de pesos para fazer predições de táticas e técnicas presentes em relatórios de CTI. You et al (2022) propõem o framework Threat Intelligence Mining (TIM), desenvolvendo a ferramenta TCENet. A solução faz sua análise agrupando conjuntos de três sentenças de modo a buscar mais contexto.…”

“…Muitos feeds de inteligência de ameaças focam nos IOCs e muitas soluções tradicionais de segurança são baseadas em IOCs. Contudo, esses dados não são suficientes para uma proteção adequada (You, et al, 2022). Carecem de contexto informacional adequado para melhor descrever o padrão de ataque.…”