mlsanityData to 14 Oct 2026

Cyber-Attack Technique Classification Using Two-Stage Trained Large Language Models

arXiv 2411.18755 ↗First posted 27 Nov 2024cs.LG cs.CL cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

Understanding the attack patterns associated with a cyberattack is crucial for comprehending the attacker's behaviors and implementing the right mitigation measures. However, majority of the information regarding new attacks is typically presented in unstructured text, posing significant challenges for security analysts in collecting necessary information. In this paper, we present a sentence classification system that can identify the attack techniques described in natural language sentences from cyber threat intelligence (CTI) reports. We propose a new method for utilizing auxiliary data with the same labels to improve classification for the low-resource cyberattack classification task. The system first trains the model using the augmented training data and then trains more using only the primary data. We validate our model using the TRAM data1 and the MITRE ATT&CK framework. Experiments show that our method enhances Macro-F1 by 5 to 9 percentage points and keeps Micro-F1 scores competitive when compared to the baseline performance on the TRAM dataset.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 17 of its 36 references that are in the map. First posted on arXiv 27 Nov 2024.

Builds on

17 of 36 references.

References · 17

  1. 2017Attention Is All You Needcited by 60,361
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  4. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
  5. 2019Unsupervised Data Augmentation for Consistency Trainingcited by 1,060
  6. 2019EDA: Easy Data Augmentation Techniques for Boosting Performance on Text Classification Taskscited by 807
  7. 2015Improving Neural Machine Translation Models with Monolingual Datacited by 788
  8. 2018Contextual Augmentation: Data Augmentation by Words with Paradigmatic Relationscited by 201
  9. 2020Sequence-Level Mixed Sample Data Augmentationcited by 71
  10. 2019Data Augmentation via Dependency Tree Morphing for Low-Resource Languagescited by 45
  11. 2021AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reportscited by 31
  12. 2022Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTIcited by 27
5 more
  1. 2020Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reportscited by 17
  2. 2020Finding Friends and Flipping Frenemies: Automatic Paraphrase Dataset Augmentation Using Graph Theorycited by 8
  3. 2020XMixup: Efficient Transfer Learning with Auxiliary Samples by Cross-domain Mixupcited by 5
  4. 2022Towards Automated Classification of Attackers' TTPs by combining NLP with ML Techniquescited by 5
  5. 2022From Threat Reports to Continuous Threat Intelligence: A Comparison of Attack Technique Extraction Methods from Textual Artifactscited by 3

Built on by

Not cited yet.