EX-Action: Automatically Extracting Threat Actions from Cyber Threat Intelligence Report Based on Multimodal Learning. (27th May 2021)

• Record Type: Journal Article
• Authors: Zhang, Huixia; Shen, Guowei; Guo, Chun; Cui, Yunhe; Jiang, Chaohui
• Other Names: Zhang Liguo Academic Editor.
• Is Part Of: Security and communication networks. Volume 2021(2021)
• Publication Date: 2021-05-27
• Subjects: Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1155/2021/5586335
• Languages: English
• ISSNs: 1939-0114

Abstract

Abstract : With the increasing complexity of network attacks, an active defense based on intelligence sharing becomes crucial. There is an important issue in intelligence analysis that automatically extracts threat actions from cyber threat intelligence (CTI) reports. To address this problem, we propose EX-Action, a framework for extracting threat actions from CTI reports. EX-Action finds threat actions by employing the natural language processing (NLP) technology and identifies actions by a multimodal learning algorithm. At the same time, a metric is used to evaluate the information completeness of the extracted action obtained by EX-Action. By the experiment on the CTI reports that consisted of sentences with complex structure, the experimental result indicates that EX-Action can achieve better performance than two state-of-the-art action extraction methods in terms of accuracy, recall, precision, and F1-score.