基于关联增强的网络威胁情报技战术分类
作者:
作者单位:

1.四川大学 计算机学院;2.四川大学 网络空间安全学院

作者简介:

通讯作者:

中图分类号:

TP183

基金项目:

国家重点研发计划 (2019QY1400); 国家自然科学基金 (U2133208); 四川省青年科技创新研究团队基金(2022JDTD0014)


RENet: tactics and techniques classifications for cyber threat intelligence with relevance enhancement
Author:
Affiliation:

1.College of Computer Science,Sichuan University;2.School of Cyber Science and Engineering,Sichuan University

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    网络威胁情报(Cyber Threat Intelligence, CTI)的技战术(Tactics, Techniques and Procedures, TTPs)分析能够为网络攻击事件提供全局视图,并揭示系统弱项,是网络攻击溯源 的关键技术.现有分类TTPs方案面向抽象语言环境效果较差且不平均.本文提出一种基于关联增强的多标签深度学习模型RENet,通过使用结合上下文信息和多词语义的多标签分类器对战术和技 术进行分类,并通过技战术条件转移矩阵将原有战术的分类结果转移到技术中增强技术分类.实验表明,RENet比其他分类模型有更精确的技战术分类效果与更快的收敛速度.在英文数据集上, RENet对技术和战术分类的F1分数比现有最好的模型分别提高4.62%和0.78%,在中文数据集上提高3.95%和3.77%.

    Abstract:

    Tactics, Techniques, and Procedures (TTPs) analysis in Cyber Threat Intelligence (CTI) providing a global view of cyberattack events and reveal system weaknesses, is a key technique for cyberattack traceability. Existing TTPs classification schemes are poorly and unevenly oriented to abstract language environments. In this paper, we propose a multi-label deep learning model based on association enhancement: RENet, which classifies tactics and techniques by using a multi-label classifier that combines contextual information and multiple word meanings, and enhances technique classification by transferring the classification results of the original tactics through a conditional transfer matrix from tactics to techniques. Experiments show that RENet has more accurate classification results of tactics and techniques with faster convergence than other classification models. The F1 scores of RENet for techniques and tactics classification are 4.62% and 0.78% higher than the best existing models on the English dataset, and 3.95% and 3.77% higher on the Chinese dataset, respectively.

    参考文献
    相似文献
    引证文献
引用本文

引用本文格式: 葛文翰,王俊峰,唐宾徽,于忠坤,陈柏翰,余坚. 基于关联增强的网络威胁情报技战术分类[J]. 四川大学学报: 自然科学版, 2022, 59: 023004.

复制
分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2021-09-14
  • 最后修改日期:2021-11-11
  • 录用日期:2021-11-19
  • 在线发布日期: 2022-04-01
  • 出版日期: