alirezaaminzadeh/attack-technique-classifier

Attack Technique Classifier

Multi-label MITRE ATT&CK technique classifier for SOC alert triage.

Architecture

• Vectorizer: TF-IDF (4096 features, 1-2 grams)
• Classifier: One-vs-Rest Logistic Regression
• Retrieval index: TF-IDF 512-dim + FAISS over STIX technique descriptions

Intended Use

Classify security alerts into MITRE ATT&CK technique IDs. Designed as part of the CyberSOC Triage Agent pipeline — not a standalone threat intelligence product.

Training Data

• alirezaaminzadeh/soc-alert-attack-dataset — 2,500 labeled alerts (primarily synthetic, mapped from Sigma/Zeek/Suricata patterns)
• MITRE ATT&CK STIX enterprise bundle for technique catalog

Evaluation (holdout)

See train_metrics.json for holdout macro/micro F1. Full pipeline metrics in dataset eval_results.json.

Limitations

• Trained predominantly on synthetic alerts; real-world SIEM exports may differ
• CPU-only inference; no GPU required
• Technique coverage limited to labels present in training corpus (~17 base techniques)
• Retrieval uses lexical TF-IDF, not neural embeddings

Built by Aria AI.