# Define the MLP model
## 5 Experiments and Evaluations
### Analysis the STIX 2.0 Records  
By the analysis, we got the Threat-articles clustered into their related events and got the events clustered into potential threat groups that may be responsible for the cybersecurity events.  
Firstly, we did a correlation analysis on the report nodes to generate \"Event\" nodes. Specifically, for two report nodes, an Event node will be established if their referred IoC nodes and vulnerability nodes have more than two pattern properties with the same value. The relationship between the newly built Event node and the two nodes is defined as \"RELATED_TO\", and a report node must be related to an Event node. Secondly, we generated the \"Potential-threat-group\" nodes from the established Events nodes. Specifically, two Event nodes will be clustered into the same Potential-threat-group node if their correlated IoC nodes or vulnerability nodes have more than one pattern properties with the same value. Note that a Potential-threat-group node must contain more than three articles. We defined the relationship between the Potential-threat-group node and the Event node as \"RESPONSIBLE_FOR\".  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**OSTIP Type** & **CSIs in Articles** & **Pre.** & **Rec.** \\ \hline Team & 121 & 95.04\% & 93.50\% \\ Individual & 183 & 94.35\% & 86.08\% \\ Company & 116 & 98.28\% & 99.13\% \\ Forum & 94 & 85.88\% & 91.25\% \\ \hline \hline \end{tabular}
\end{table}
Table 10: Accuracy of CSI extractor.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Feature** & **Feature** & **XGBoost** & **MLP** & **SVM** & **Decision Trees** & **Random Forest** \\ \hline \multirow{4}{*}{F} & Topic word & \multirow{2}{*}{80.13\%} & \multirow{2}{*}{65.71\%} & \multirow{2}{*}{51.15\%} & \multirow{2}{*}{74.73\%} & \multirow{2}{*}{60.00\%} \\  & Dictionary-word ratio & & & & & \\ \multicolumn{5}{c}{Article length} & & & & \\ \cline{1-1} \cline{3-7}  & SecurityAction-word density & & & & & \\ \cline{1-1} \cline{3-7} H & SecurityTarget-word density & & & & & \\ \multicolumn{5}{c}{Article length} & & & & \\ \hline \hline \end{tabular}
\end{table}
Table 9: Classification accuracy of classifiers with article length as feature.  
Figure 9 is an established Potential-threat-group node and its related nodes. By checking in manually, we found the Potential-threat-group node indicated the APT28 group, and the related report nodes indicated the articles published by cybersecurity teams aiming to discover this Russian government conducting threat group.  
The experiment results proved the CTI database can help security staff efficiently query and analyze the data, and the query results can be visualized directly. The CTI records obtained through GCO can effectively help security staff perform more efficient work, including CTI sorting and further analysis. We hope that GCO can provide more information to assist security personnel in making decisions, and summarize the attack methods and tools commonly used by APT groups. When new security threats appear, the GCO can help security staff detect and deal with them in time, which can also minimize losses, predict the source of the cyber-attack, and locate the potential APT group.