Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognition

arXiv:2401.10337v5 Announce Type: replace-cross Abstract: Tactics, Techniques and Procedures (TTPs) represent sophisticated attack patterns in the cybersecurity domain, described encyclopedically in textual knowledge bases. Identifying TTPs in cybersecurity writing, often called *TTP mapping*, is an important and challenging task. Conventional learning approaches often target the problem in the classical multi-class or multi-label classification setting. This setting hinders the learning ability of the model due to a large number of classes (i.e., TTPs), the inevitable skewness of the label distribution and the complex hierarchical structure of the label space. We formulate the problem in a different learning paradigm, where the assignment of a text to a TTP label is decided by the direct semantic similarity between the two, thus reducing the complexity of competing solely over the large labeling space. To that end, we propose a neural matching architecture with a sampling-based learn-to-compare mechanism and two complementary sampled objectives: $\alpha$-balanced NCE controls the collective mass, but not the internal ordering, of sampled negatives; asymmetric focusing controls individual comparisons under incomplete annotation.

Abstract:Tactics, Techniques and Procedures (TTPs) represent sophisticated attack patterns in the cybersecurity domain, described encyclopedically in textual knowledge bases. Identifying TTPs in cybersecurity writing, often called *TTP mapping*, is an important and challenging task. Conventional learning approaches often target the problem in the classical multi-class or multi-label classification setting. This setting hinders the learning ability of the model due to a large number of classes (i.e., TTPs), the inevitable skewness of the label distribution and the complex hierarchical structure of the label space. We formulate the problem in a different learning paradigm, where the assignment of a text to a TTP label is decided by the direct semantic similarity between the two, thus reducing the complexity of competing solely over the large labeling space. To that end, we propose a neural matching architecture with a sampling-based learn-to-compare mechanism and two complementary sampled objectives: $\alpha$-balanced NCE controls the collective mass, but not the internal ordering, of sampled negatives; asymmetric focusing controls individual comparisons under incomplete annotation.

Machine Learning (cs.LG); Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Cryptography and Security (cs.CR)

arXiv:2401.10337 [cs.LG]

(or arXiv:2401.10337v5 [cs.LG] for this version)

https://doi.org/10.48550/arXiv.2401.10337 Focus to learn more arXiv-issued DOI via DataCite

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

analiza aiqbench

Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognition

Subiecte conexe