title: Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼ÐµÑÐ¾Ð´Ð° ÑÐµÑÐµÐ½Ð¸Ñ Ð·Ð°Ð´Ð°ÑÐ¸ Ð¼Ð½Ð¾Ð³Ð¾Ð·Ð½Ð°ÑÐ½Ð¾Ð¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ Ð´Ð»Ñ Ð¸Ð·Ð²Ð»ÐµÑÐµÐ½Ð¸Ñ ÑÐ°ÐºÑÐ¸Ðº Ð¸ ÑÐµÑ Ð½Ð¸Ðº MITRE ATT&amp;CK Ð¸Ð· Ð¾ÑÑÐµÑÐ¾Ð² Ð¾Ð± ÑÐ³ÑÐ¾Ð·Ð°Ñ ÐºÐ¸Ð±ÐµÑÐ±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¼Ð°Ð³Ð¸ÑÑÑÐ°
titleType: Subtitle
title: Development of a method for solving the multilabel classification problem for extracting MITRE ATT&amp;CK tactics and techniques from cybersecurity threat reports
Creators: name: Ð¨Ð°ÑÐ¸Ð¿Ð¾Ð², ÐÐ¼Ð¸ÑÑÐ¸Ð¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: Ð¼Ð½Ð¾Ð³Ð¾Ð·Ð½Ð°ÑÐ½Ð°Ñ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ñ
Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
ÐºÐ¸Ð±ÐµÑÐ±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑ
multilabel classification
machine learning
cybersecurity

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¸ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ Ð¼ÐµÑÐ¾Ð´Ð° Ð¸Ð·Ð²Ð»ÐµÑÐµÐ½Ð¸Ñ ÑÐ°ÐºÑÐ¸Ðº Ð¸ ÑÐµÑÐ½Ð¸Ðº MITRE ATT&amp;CK Ð¸Ð· Ð¾ÑÑÐµÑÐ¾Ð² Ð¾Ð± ÑÐ³ÑÐ¾Ð·Ð°Ñ ÐºÐ¸Ð±ÐµÑÐ±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² ÑÐ°Ð¼ÐºÐ°Ñ Ð·Ð°Ð´Ð°ÑÐ¸ Ð¼Ð½Ð¾Ð³Ð¾Ð·Ð½Ð°ÑÐ½Ð¾Ð¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¼Ð½Ð¾Ð³Ð¾Ð·Ð½Ð°ÑÐ½Ð¾Ð¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ ÑÐµÐºÑÑÐ¾Ð²ÑÑ Ð´Ð°Ð½Ð½ÑÑ. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð¿ÑÐ¾ÑÐµÑÑÐ° Ð¾Ð±Ð¼ÐµÐ½Ð° Ð´Ð°Ð½Ð½ÑÐ¼Ð¸ Ð¾ ÐºÐ¸Ð±ÐµÑÑÐ³ÑÐ¾Ð·Ð°Ñ (CTI). 2. ÐÐ½Ð°Ð»Ð¸Ð· Ð±Ð°Ð·Ñ Ð´Ð°Ð½Ð½ÑÑ MITRE ATT&amp;CK. 3. ÐÐ±Ð·Ð¾Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² ÑÐµÑÐµÐ½Ð¸Ñ Ð·Ð°Ð´Ð°ÑÐ¸ Ð¼Ð½Ð¾Ð³Ð¾Ð·Ð½Ð°ÑÐ½Ð¾Ð¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸. 4. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¸ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ Ð¼ÐµÑÐ¾Ð´Ð° Ð¸Ð·Ð²Ð»ÐµÑÐµÐ½Ð¸Ñ ÑÐ°ÐºÑÐ¸Ðº Ð¸ ÑÐµÑÐ½Ð¸Ðº MITRE ATT&amp;CK Ð¸Ð· Ð¾ÑÑÐµÑÐ¾Ð² Ð¾Ð± ÑÐ³ÑÐ¾Ð·Ð°Ñ ÐºÐ¸Ð±ÐµÑÐ±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² ÑÐ°Ð¼ÐºÐ°Ñ Ð·Ð°Ð´Ð°ÑÐ¸ Ð¼Ð½Ð¾Ð³Ð¾Ð·Ð½Ð°ÑÐ½Ð¾Ð¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸. 5. ÐÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½ÑÑ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ð¹ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð° Ð¸ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ¾Ð². Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ñ Ð¿ÑÐ¾ÑÐµÑÑ Ð¾Ð±Ð¼ÐµÐ½Ð° CTI, Ð° ÑÐ°ÐºÐ¶Ðµ ÑÑÑÑÐºÑÑÑÐ° Ð¸ Ð²Ð°ÑÐ¸Ð°Ð½ÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ Ð±Ð°Ð·Ñ Ð´Ð°Ð½Ð½ÑÑ MITRE ATT&amp;CK. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¼Ð½Ð¾Ð³Ð¾Ð·Ð½Ð°ÑÐ½Ð¾Ð¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ ÑÐµÐºÑÑÐ¾Ð²ÑÑ Ð´Ð°Ð½Ð½ÑÑ. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ» ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¼ÐµÑÐ¾Ð´ Ð¸Ð·Ð²Ð»ÐµÑÐµÐ½Ð¸Ñ ÑÐ°ÐºÑÐ¸Ðº Ð¸ ÑÐµÑÐ½Ð¸Ðº Ð¸Ð· Ð¾ÑÑÐµÑÐ¾Ð² CTI, ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ ÐºÐ¾ÑÐ¾ÑÐ¾Ð³Ð¾ Ð±ÑÐ»Ð° Ð¿ÑÐ¾Ð´ÐµÐ¼Ð¾Ð½ÑÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð° Ð² ÑÐ¾Ð´Ðµ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½ÑÑ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ð¹. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½ÑÐ¹ Ð¼ÐµÑÐ¾Ð´ Ð¼Ð¾Ð¶ÐµÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½ Ð´Ð»Ñ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸Ð¹.
description: The purpose of the study is to develop and implement a method for extracting MITRE ATT&amp;CK tactics and techniques from cybersecurity threat reports within the framework of a multilabel classification task. The subject of the work is modern methods of multilabel text classification. The research set the following goals: 1. Investigation of the cyber threat intelligence (CTI) exchange process. 2. Analysis of the MITRE ATT&amp;CK database. 3. Review of existing methods for solving the multilabel classification task. 4. Development and implementation of a method for extracting MITRE ATT&amp;CK tactics and techniques from cybersecurity threat reports within the framework of a multi-label classification task. 5. Conducting experimental research on the developed method and analyzing the results. During the work the process of CTI exchange, as well as the structure and use cases of the MITRE ATT&amp;CK database, were investigated. Existing methods of multi-label text classification were analyzed. As a result of the work, a method for extracting tactics and techniques from CTI reports was developed, the effectiveness of which was demonstrated in experimental studies. The developed method can be used to ensure the information security of enterprises.