Cyber Threat Intelligence Extraction in Power Sector Using Deep Learning - Dutta, Abir; Bhushan, Bharat; Kant, Shri (International Journal of Intelligent Systems and Applications in Engineering, 2024)
Techniques, tactics, and procedures (TTPs) for threat intelligence (CTI) domain identification and extraction helps security analysts to determine the technical risks and recover the entire picture of cyber-attacks. Without sufficient domain background, frameworks can scarcely offer standard and comprehensive processing methods for TTPs extracting information. In this study, a multi-instance learning method called Power Sector Mask is suggested as a remedy of such backdrops. Power Sector collects behavioural epoch from CTI and using conditional distribution, forecasts the labels of TTPs. Yet, the structure provides two ways to assess the legitimacy of terms. One employing verification from experience by obstructing already-existing epoch, the other one confirms the misrepresentation of the categorization effect. In the trials, Power Sector achieved F1 scores for TTP Techniques of power sector mask model viz. AR_mask, SV_mask and MP_mask is 20.70%, 68.33% and 68.50% and F1 scores for TTP Tactics CNN and RNN are 30.7%, 67.34% and 69.70% respectively. In particular, deep leering model is use classification of model of F1 score in Tactics is better or lower than mask Techniques. In this research we also confirm the feasibility to obtain TTPs from malware with an enhanced F1 of POS-CNN is better/lower than all CNN and RNN.