Construction of TTPS From APT Reports Using Bert

With the ongoing usage of networks, the number of Advanced Persistent Threat (APT) attacks has grown in recent years. When compared to real-time APT attack detection, analyzing APT reports enables faster dissemination of cyber threat intelligence (CTI) and identification of APT attacks. Thus, this paper proposes a model for automatically extracting threat actions and generating Tactics, Techniques and Procedures (TTPs) from APT reports. The model analyzes the semantics of APT reports and extracts threat actions automatically based on BERT-BiLSTM-CRF that can accurately capture the semantics of sentences. A sentence containing a threat action is fed into the trained model, and the model marks the threat action contained in the sentence. Then, we leverage existing knowledge to build a cyber threat ontology, obtain complete attack information by mapping threat actions to the ontology, and generate high-level Indicators of Compromise (IOC) and generate TTPs. Threat actions are mapped to this ontology to construct TTPs. In comparison to traditional approaches, our method achieves an average of 96% precision on the test dataset.