nanda-rani commited on
Commit
bddb583
·
verified ·
1 Parent(s): abfb4e5

Update README.md

Browse files
Files changed (1) hide show
  1. README.md +1 -5
README.md CHANGED
@@ -11,8 +11,6 @@ language:
11
  The **TTPXHunter** model is designed to automate the extraction of actionable threat intelligence by identifying **Tactics, Techniques, and Procedures (TTPs)** from unstructured narrative threat reports. Using natural language processing (NLP) techniques, TTPXHunter processes text, identifying adversarial tactics and techniques in accordance with established frameworks like MITRE ATT&CK. The model filters predictions based on a confidence threshold, ensuring only high-confidence TTPs are considered for analysis. Once identified, these TTPs are mapped to predefined labels, converting them into actionable insights for cybersecurity teams. This automation enhances the speed and accuracy of threat intelligence gathering, allowing for timely and effective responses to emerging threats.
12
 
13
 
14
- ## Model Details
15
-
16
  ### Model Description
17
 
18
  <!-- Provide a longer summary of what this model is. -->
@@ -218,9 +216,7 @@ publisher = {Association for Computing Machinery},
218
  address = {New York, NY, USA},
219
  url = {https://doi.org/10.1145/3696427},
220
  doi = {10.1145/3696427},
221
- abstract = {Understanding the modus operandi of adversaries aids organizations to employ efficient defensive strategies and share intelligence in the community. This knowledge is often present in unstructured natural language text within threat analysis reports. A translation tool is needed to interpret the modus operandi explained in the sentences of the threat report and convert it into a structured format. This research introduces a methodology named TTPXHunter for automated extraction of threat intelligence in terms of Tactics, Techniques, and Procedures (TTPs) from finished cyber threat reports. It leverages cyber domain-specific state-of-the-art natural language model to augment sentences for minority class TTPs and refine pinpointing the TTPs in threat analysis reports significantly. We create two datasets: an augmented sentence-TTP dataset of (39,296) sentence samples and a (149) real-world cyber threat intelligence report-to-TTP dataset. Further, we evaluate TTPXHunter on the augmented sentence and report datasets. The TTPXHunter achieves the highest performance of (92.42\%) f1-score on the augmented dataset, and it also outperforms existing state-of-the-art TTP extraction method by achieving an f1-score of (97.09\%) when evaluated over the report dataset. TTPXHunter significantly improves cybersecurity threat intelligence by offering quick, actionable insights into attacker behaviors. This advancement automates threat intelligence analysis and provides a crucial tool for cybersecurity professionals to combat cyber threats.},
222
- note = {Just Accepted},
223
- journal = {Digital Threats},
224
  month = {sep},
225
  keywords = {Threat Intelligence, TTP Extraction, MITRE ATT&CK, Natural Language Processing, Threat Intelligence Extraction, TTP Classification, Cyber Security and AI, Cyber Security Threats, NLP, Cybersecurity}
226
  }
 
11
  The **TTPXHunter** model is designed to automate the extraction of actionable threat intelligence by identifying **Tactics, Techniques, and Procedures (TTPs)** from unstructured narrative threat reports. Using natural language processing (NLP) techniques, TTPXHunter processes text, identifying adversarial tactics and techniques in accordance with established frameworks like MITRE ATT&CK. The model filters predictions based on a confidence threshold, ensuring only high-confidence TTPs are considered for analysis. Once identified, these TTPs are mapped to predefined labels, converting them into actionable insights for cybersecurity teams. This automation enhances the speed and accuracy of threat intelligence gathering, allowing for timely and effective responses to emerging threats.
12
 
13
 
 
 
14
  ### Model Description
15
 
16
  <!-- Provide a longer summary of what this model is. -->
 
216
  address = {New York, NY, USA},
217
  url = {https://doi.org/10.1145/3696427},
218
  doi = {10.1145/3696427},
219
+ journal = {Digital Threats: Research and Practice},
 
 
220
  month = {sep},
221
  keywords = {Threat Intelligence, TTP Extraction, MITRE ATT&CK, Natural Language Processing, Threat Intelligence Extraction, TTP Classification, Cyber Security and AI, Cyber Security Threats, NLP, Cybersecurity}
222
  }