Abstract:Abstract TTPs (Tactics, Techniques, and Procedures), which represent an attacker’s goals and methods, are the long period and essential feature of the attacker. Defenders can use TTP intelligence to perform the penetration test and compensate for defense deficiency. However, most TTP intelligence is described in unstructured threat data, such as APT analysis reports. Manually converting natural language TTPs descriptions to standard TTP names, such as ATT&CK TTP names and IDs, is time-consuming and requires deep expertise. In this paper, we define the TTP classification task as a sentence classification task. We annotate a new sentence-level TTP dataset with 6 categories and 6061 TTP descriptions from 10761 security analysis reports. We construct a threat context-enhanced TTP intelligence mining (TIM) framework to mine TTP intelligence from unstructured threat data. The TIM framework uses TCENet (Threat Context Enhanced Network) to find and classify TTP descriptions, which we define as three continuous sentences, from textual data. Meanwhile, we use the element features of TTP in the descriptions to enhance the TTPs classification accuracy of TCENet. The evaluation result shows that the average classification accuracy of our proposed method on the 6 TTP categories reaches 0.941 . The evaluation results also show that adding TTP element features can improve our classification accuracy compared to using only text features. TCENet also achieved the best results compared to the previous document-level TTP classification works and other popular text classification methods, even in the case of few-shot training samples. Finally, the TIM framework organizes TTP descriptions and TTP elements into STIX 2.1 format as final TTP intelligence for sharing the long-period and essential attack behavior characteristics of attackers. In addition, we transform TTP intelligence into sigma detection rules for attack behavior detection. Such TTP intelligence and rules can help defenders deploy long-term effective threat detection and perform more realistic attack simulations to strengthen defense.

Price TAG: Towards Semi-Automatically Discovery Tactics, Techniques and Procedures OF E-Commerce Cyber Threat Intelligence

TIM: threat context-enhanced TTP intelligence mining on unstructured threat data

TTPXHunter: Actionable Threat Intelligence Extraction as TTPs from Finished Cyber Threat Reports

Automatic Extraction Of Commodity Attributes On Webpages Based On Hierarchical Structure

Detecting And Characterizing Web Bot Traffic In A Large E-Commerce Marketplace

TIMiner: Automatically extracting and analyzing categorized cyber threat intelligence from social data

Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports

TSTEM: A Cognitive Platform for Collecting Cyber Threat Intelligence in the Wild

Automated discovery and mapping ATT&CK tactics and techniques for unstructured cyber threat intelligence

What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey

CATS: Cross-Platform E-Commerce Fraud Detection

P-TIMA: a framework of T witter threat intelligence mining and analysis based on a prompt-learning NER model

A System for Efficiently Hunting for Cyber Threats in Computer Systems Using Threat Intelligence

Enabling Efficient Cyber Threat Hunting with Cyber Threat Intelligence

ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management

NLP-Based Techniques for Cyber Threat Intelligence

CVE-driven Attack Technique Prediction with Semantic Information Extraction and a Domain-specific Language Model

TMID: A Comprehensive Real-world Dataset for Trademark Infringement Detection in E-Commerce

AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports

Tactics, Techniques, and Procedures (TTPs) in Interpreted Malware: A Zero-Shot Generation with Large Language Models

Online E-Commerce Fraud: A Large-Scale Detection And Analysis