Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognition
cs.LG, cs.AI, cs.CL, cs.CR
Submitted: 2024-01-18
Updated: 2026-08-26
Comments: accepted at EACL 2024, in ARR October 2023
Code: https://github.com/CTID/TRAM
License: http://creativecommons.org/licenses/by/4.0/
The gist: Tactics, Techniques and Procedures (TTPs) represent sophisticated attack patterns in the cybersecurity domain, described encyclopedically in textual knowledge bases.
Terminology
Abstract
Tactics, Techniques and Procedures (TTPs) represent sophisticated attack patterns in the cybersecurity domain, described encyclopedically in textual knowledge bases. Identifying TTPs in cybersecurity writing, often called *TTP mapping*, is an important and challenging task. Conventional learning approaches often target the problem in the classical multi-class or multi-label classification setting. This setting hinders the learning ability of the model due to a large number of classes (i.e., TTPs), the inevitable skewness of the label distribution and the complex hierarchical structure of the label space. We formulate the problem in a different learning paradigm, where the assignment of a text to a TTP label is decided by the direct semantic similarity between the two, thus reducing the complexity of competing solely over the large labeling space. To that end, we propose a neural matching architecture with a sampling-based learn-to-compare mechanism and two complementary sampled objectives: α-balanced NCE controls the collective mass, but not the internal ordering, of sampled negatives; asymmetric focusing controls individual comparisons under incomplete annotation.
Sources
- Extreme Classification via Adversarial Softmax Approximation
- Probabilistic Label Trees for Extreme Multi-label Classification
- Representation Learning with Contrastive Predictive Coding
- Deep Learning is Robust to Massive Label Noise
Related papers
- Polynomial-Augmented Neural Networks (PANNs) with Weak Orthogonality Constraints for Enhanced Function and PDE Approximation
- AIRL-S: Unifying Reinforcement Learning and Search-Based Test-Time Scaling via Adversarial Inverse Reinforcement Learning
- Transformers as Bayesian In-Context Experimenters: Smoothness-Adaptive Efficient ATE Estimation
- Convergence issues in Relational Concept Analysis based on AOC-posets
- Beliefs Beyond Posteriors: The Predictive Cost of ELBO Binding
- Understanding Diffusion Models via Ratio-Based Function Approximation with SignReLU Networks