THREAT REPORT ATT&CK MAPPER (TRAM)

Project Summary

Published : Aug 28, 2023

The cybersecurity community has been working for years to automatically identify adversary tactics, techniques, and procedures (TTPs) in cyber threat intelligence (CTI) reports. With some advances in machine learning and artificial intelligence, TRAM is a solution that is measurably effective at solving that problem.

Previous iterations of the Threat Report ATT&CK Mapper (TRAM) focused on creating a data annotation tool and using supervised learning methods to extract and predict TTPs. Our latest project improves the quality of the training data and makes effective use of fine-tuned Large Language Models (LLMs) for model training and predictions. We have improved the speed and accuracy of TTP mappings to meet the demands of defenders.

Problem

The cybersecurity community needs to identify which adversary tactics, techniques, and procedures (TTPs) are found in cyber threat intelligence (CTI) reports. This task of mapping TTPs is difficult, error-prone, and time-consuming.