Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports

Understand

Over the last years, threat intelligence sharing has steadily grown, leading cybersecurity professionals to access increasingly larger amounts of heterogeneous data.

• Among those, cyber attacks' Tactics, Techniques and Procedures (TTPs) have proven to be particularly valuable to characterize threat actors' behaviors and, thus, improve defensive countermeasures.
• Unfortunately, this information is often hidden within human-readable textual reports and must be extracted manually.
• In this paper, we evaluate several classification approaches to automatically retrieve TTPs from unstructured text.