Kaisei's CVE-Driven Attack Technique Prediction with Semantic Information Extraction and a Domain-Specific Language Model

This is my personal note about the paper introduction. https://arxiv.org/abs/2309.02785

Abstract

This paper proposed new techniques called "TTPpredictor" which predict TTP within the ATT&CK framework by CVE information. They uses Semantic Role Labeling(SRL) and SecureBERT. The method's accuracy is over 90%.

Objective

CVE are common vulnerability format but it don't describe how to be used by attacker(TTP). This paper focus to fill the gaps.

RQ.1: How can semantic role labeling techniques be effectively employed to generate a labeled dataset in the cybersecurity domain for different tasks?
RQ.2: To what extent does the utilization of context-oriented classification model design enhance the performance and robustness of the classification approach?
RQ.3: What are the strengths and limitations of the proposed methodology for the functionality-based classification of CVEs, and how can it be improved using state-of-the-art language models such as ChatGPT?

Methods

Data Extraction, Annotation, and Assessment
- Extract attach action from CVE descriptions with using SRL.
- Express attack action by SVO format and maps MITRE ATT&CK Framework
Use SecureBERT
- SecureBERT learning relativity between SVO contents and CVE description.

Results

Proposed methods "TTPpredictor" achieved approximately 98% accuracy categorize to TTP for CVE.
- F1 Score is 95% ~98%
TTPpredictor performance is better than ChatGPT
- Test 100 randomly selected CVEs
  - TTPpredictor achieves an average accuracy of 93%
  - ChatGPT’s accuracy is 20%.

Interesting points

Extract SVO structure from CVE description using SRL.
The method is able to predict TTP from CVE with higher accuracy than I had thought.

Phrase