Tactics, Techniques and Procedures (TTPs) represent sophisticated attack patterns in the cybersecurity domain, described encyclopedically in textual knowledge bases. Identifying TTPs in cybersecurity writing, often called TTP mapping, is an important and challenging task. Conventional learning approaches often target the problem in the classical multi-class or multilabel classification setting. This setting hinders the learning ability of the model due to a large number of classes (i.e., TTPs), the inevitable skewness of the label distribution and the complex hierarchical structure of the label space. We formulate the problem in a different learning paradigm, where the assignment of a text to a TTP label is decided by the direct semantic similarity between the two, thus reducing the complexity of competing solely over the large labeling space. To that end, we propose a neural matching architecture with an effective sampling-based learn-to-compare mechanism, facilitating the learning process of the matching model despite constrained resources.

在网络安全领域中，战术、技术和程序（TTP）代表复杂的攻击模式，文本知识库中以百科全书的形式描述。寻找网络安全写作中的TTP，通常称为TTP映射，是一项重要且具有挑战性的任务。为了减少模型学习能力受限的问题，我们采用了一种不同的学习范式，即通过文本与TTP标签之间的直接语义相似性来决定文本与TTP标签的关联，从而降低了仅在庞大的标签空间中竞争的复杂性。为此，我们提出了一种具有有效基于采样的学习比较机制的神经匹配架构，以便使匹配模型能够在资源受限的情况下进行学习。

基于噪声对比估计的低资源安全攻击模式识别匹配框架