RENet: tactics and techniques classifications for cyber threat intelligence with relevance enhancement

Abstract:

Tactics, Techniques, and Procedures (TTPs) analysis in Cyber Threat Intelligence (CTI) providing a global view of cyberattack events and reveal system weaknesses, is a key technique for cyberattack traceability. Existing TTPs classification schemes are poorly and unevenly oriented to abstract language environments. In this paper, we propose a multi-label deep learning model based on association enhancement: RENet, which classifies tactics and techniques by using a multi-label classifier that combines contextual information and multiple word meanings, and enhances technique classification by transferring the classification results of the original tactics through a conditional transfer matrix from tactics to techniques. Experiments show that RENet has more accurate classification results of tactics and techniques with faster convergence than other classification models. The F1 scores of RENet for techniques and tactics classification are 4.62% and 0.78% higher than the best existing models on the English dataset, and 3.95% and 3.77% higher on the Chinese dataset, respectively.