Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognition

Tactics, Techniques and Procedures (TTPs) represent sophisticated attack patterns in the cybersecurity domain, described encyclopedically in textual knowledge bases. Identifying TTPs in cybersecurity writing, often called TTP mapping, is an important and challenging task. Conventional learning approaches often target the problem in the classical multi-class or multilabel classification setting. This setting hinders the learning ability of the model due to a large number of classes (i.e., TTPs), the inevitable skewness of the label distribution and the complex hierarchical structure of …

class classification cs.ai cs.cl cs.cr cs.lg cybersecurity domain framework knowledge low mapping noise pattern recognition patterns recognition security tactics textual writing