THREAT REPORT ATT&CK MAPPER (TRAM)
Project Summary
Published : Sep 30, 2021
TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE ATT&CK®. TRAM enables researchers to test and refine Machine Learning (ML) models for identifying ATT&CK techniques in prose-based threat intel reports and allows threat intel analysts to train ML models and validate ML results.
Through research into automating the mapping of cyber threat intel reports to ATT&CK, TRAM aims to reduce the cost and increase the effectiveness of integrating ATT&CK into cyber threat intelligence across the community. Threat intel providers, threat intel platforms, and analysts should be able to use TRAM to integrate ATT&CK more easily and consistently into their products.
Problem
Mapping new threat intel reports to ATT&CK is difficult, error prone, and time consuming.
SOLUTION
Develop an open-source platform for researching the application of NLP and ML to identify TTPs in threat intel reports and allow analysts to validate those TTPs.
IMPACT
Accelerate research into automated TTP identification in threat intel reports to greatly reduce the time and effort required to integrate new intelligence into cyber operations.
Project Resources:
funding Research Participants
Share this project
Stay Informed
Stay informed about new releases of R&D projects and other exciting updates from the Center for Threat-Informed Defense.