Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognition

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

arXiv:2401.10337v5 Announce Type: replace Abstract: Tactics, Techniques and Procedures (TTPs) represent sophisticated attack patterns in the cybersecurity domain, described encyclopedically in textual knowledge bases. Identifying TTPs in cybersecurity writing, often called *TTP mapping*, is an important and challenging task. Conventional learning approaches often target the problem in the classical multi-class or multi-label classification setting. This setting hinders the learning ability of the model due to a large number of classes (i.e., TTPs), the inevitable skewness of the label distribution and the complex hierarchical structure of the label space. We formulate the problem in a different learning paradigm, where the assignment of a text to a TTP label is decided by the direct semantic similarity between the two, thus reducing the complexity of competing solely over the large labeling space. To that end, we propose a neural matching architecture with a sampling-based learn-to-compare mechanism and two complementary sampled objectives: $\alpha$-balanced NCE controls the collective mass, but not the internal ordering, of sampled negatives; asymmetric focusing controls individual comparisons under incomplete annotation.

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://arxiv.org/abs/2401.10337
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.