Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognition. (arXiv:2401.10337v3 [cs.LG] UPDATED)

Tactics, Techniques and Procedures (TTPs) represent sophisticated attack
patterns in the cybersecurity domain, described encyclopedically in textual
knowledge bases. Identifying TTPs in cybersecurity writing, often called TTP
mapping, is an important and challenging task. Conventional learning approaches
often target the problem in the classical multi-class or multilabel
classification setting. This setting hinders the learning ability of the model
due to a large number of classes (i.e., TTPs), the inevitable skewness of the
label distribution and the complex hierarchical structure of …

arxiv attack called class cybersecurity domain framework important knowledge low mapping noise patterns problem procedures recognition resource security tactics target task techniques techniques and procedures ttp ttps writing