Research on the classification of cyber threat intelligence techniques and tactics based on attention mechanism and feature fusion

Abstract:

Among the information contained in cyber threat intelligence, the tactics, techniques, and procedures (TTPs) associated with cyber attacks are the key information that best portrays organisational behaviour. However, TTPs information has a high level of abstraction and is often found in cyber threat intelligence texts with irregular grammatical structures. This makes it difficult for traditional manual analysis methods and feature engineering-based machine learning methods to quickly and effectively classify TTPs from them, and the use of a single deep learning feature extractor leads to low accuracy in TTP classification because it cannot extract the complete neighbourhood features and sequence features in the text semantics. To address these problems, this paper proposes a deep learning model based on attention mechanism and feature fusion: ACRCNN, for the classification of TTPs and techniques in cyber threat intelligence. The model extracts the neighbourhood and sequence information in the cyber threat intelligence text by convolutional and recurrent neural networks simultaneously, and then completes deep feature extraction and dimensionality reduction by convolutional and pooling layers to complete feature fusion. Then, feature weighting is completed by the attention layer, and finally the classification of tactics and techniques is completed by the fully connected layer. The experimental results show that ACRCNN performs well in tactical and technical classification tasks, achieving 91.91% and 83.86% in F1 metrics, which is an improvement of 2.46% and 4.94%, respectively, compared with existing models.