{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T15:12:53Z","timestamp":1793545973304,"version":"4.5.0"},"reference-count":37,"publisher":"Oxford University Press (OUP)","issue":"8","license":[{"start":{"date-parts":[[2022,4,21]],"date-time":"2022-04-21T00:00:00Z","timestamp":1650499200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/academic.oup.com\/journals\/pages\/open_access\/funder_policies\/chorus\/standard_publication_model"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,8,14]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>Completing the classification of tactics and techniques in cyber threat intelligence (CTI) is an important way to obtain tactics, techniques and procedures (TTPs) and portray the behavior of cyber attacks. However, the high level of abstraction of tactics and techniques information and their presence in CTI, usually in the form of natural language text, make it difficult for traditional manual analysis methods and feature engineering-based machine learning methods to complete the classification of tactics and techniques effectively. Meanwhile, flat deep learning methods do not perform well in classifying more fine-grained techniques due to their inability to exploit the hierarchical relationship between tactics and techniques. Therefore, this paper regards the tactics and techniques of TTPs defined in Adversarial Tactics, Techniques and Common Knowledge knowledge base as labels and proposes a Convolutional Neural Network (CNN) model based on hierarchical knowledge migration and attention mechanism for classifying tactics and techniques in CTI, named HM-ACNN (CNN based on hierarchical knowledge migration and attention mechanism). HM-ACNN classifies tactics and techniques into two phases, and the underlying network model for both phases is the Attention-based CNN network. The first step in HM-ACNN is converting the CTI text into a two-dimensional image based on the word embedding model, and then start training the classification of tactics through the CNN structure based on the attention mechanism before the classification of techniques. Secondly, after the tactics classification training is completed, the tactic-to-technique knowledge migration is then completed by transforming the parameters of the CNN layer and the attention layer in the tactics classification process based on the special hierarchical relationship between tactics and techniques. Then, the classification of techniques is finished by fine-tuning. The experimental results show that HM-ACNN performs well in the tactics and techniques classification tasks, and the metric F1 values reach 93.66% and 86.29%, which are better than other models such as CNN, Recurrent Neural Network and CRNN (Recurrent Convolutional Neural Networks).<\/jats:p>","DOI":"10.1093\/comjnl\/bxac048","type":"journal-article","created":{"date-parts":[[2022,4,14]],"date-time":"2022-04-14T11:13:14Z","timestamp":1649934794000},"page":"1870-1881","source":"Crossref","is-referenced-by-count":16,"title":["Tactics And Techniques Classification In Cyber Threat Intelligence"],"prefix":"10.1093","volume":"66","author":[{"given":"Zhongkun","family":"Yu","sequence":"first","affiliation":[{"name":"College of Computer Science , Sichuan University, Chengdu 610065, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"JunFeng","family":"Wang","sequence":"additional","affiliation":[{"name":"College of Computer Science , Sichuan University, Chengdu 610065, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"BinHui","family":"Tang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering , Sichuan University, Chendu 610065, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Li","family":"Lu","sequence":"additional","affiliation":[{"name":"College of Computer Science , Sichuan University, Chengdu 610065, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2022,4,21]]},"reference":[{"key":"2023081805144569600_ref1","volume-title":"Q1 2021 cyber attack statistics","author":"Passeri"},{"key":"2023081805144569600_ref2","doi-asserted-by":"crossref","first-page":"24","DOI":"10.1016\/S2212-5671(15)01077-1","article-title":"Cyber-attacks\u2013trends, patterns and security countermeasures","volume":"28","author":"Bendovschi","year":"2015","journal-title":"Procedia Economics and Finance"},{"key":"2023081805144569600_ref3","first-page":"54","volume-title":"International conference on applications and techniques in information security","author":"Chowdhury","year":"2016"},{"key":"2023081805144569600_ref4","doi-asserted-by":"crossref","first-page":"605","DOI":"10.1177\/0018720812464045","article-title":"Cyber situation awareness: modeling detection of cyber attacks with instance-based learning theory","volume":"55","author":"Dutt","year":"2013","journal-title":"Hum. Factors"},{"key":"2023081805144569600_ref5","volume-title":"The pyramid of pain","author":"Bianco"},{"key":"2023081805144569600_ref6","first-page":"1","volume-title":"Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security","author":"Husari","year":"2019"},{"key":"2023081805144569600_ref7","doi-asserted-by":"crossref","first-page":"101817","DOI":"10.1016\/j.cose.2020.101817","article-title":"Improving siem alert metadata aggregation with a novel kill-chain based classification model","volume":"94","author":"Bryant","year":"2020","journal-title":"Comput. Secur."},{"key":"2023081805144569600_ref8","doi-asserted-by":"crossref","first-page":"406","DOI":"10.1007\/978-3-030-37228-6_20","volume-title":"Security and Privacy in Communication Networks","author":"Oosthoek","year":"2019"},{"key":"2023081805144569600_ref9","doi-asserted-by":"crossref","first-page":"106","DOI":"10.1109\/RWS50334.2020.9241271","volume-title":"2020 Resilience Week (RWS)","author":"Kwon","year":"2020"},{"key":"2023081805144569600_ref10","volume-title":"Automated retrieval of att&ck tactics and techniques for cyber threat reports","author":"Legoy","year":"2020"},{"key":"2023081805144569600_ref11","doi-asserted-by":"crossref","first-page":"811","DOI":"10.18653\/v1\/D18-1093","volume-title":"Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing","author":"Shimura","year":"2018"},{"key":"2023081805144569600_ref12","author":"The openioc framework"},{"key":"2023081805144569600_ref13","volume-title":"Standardizing cyber threat intelligence information with the structured threat information expression (stix)","author":"Barnum","year":"2012"},{"key":"2023081805144569600_ref14","first-page":"1","volume-title":"MILCOM 2018\u20132018 IEEE Military Communications Conference (MILCOM)","author":"Vakilinia","year":"2018"},{"key":"2023081805144569600_ref15","doi-asserted-by":"crossref","first-page":"16","DOI":"10.12948\/issn14531305\/20.3.2016.02","article-title":"Secure threat information exchange across the internet of things for cyber defense in a fog computing environment","volume":"20","author":"Ionita","year":"2016","journal-title":"Informatica Economica"},{"key":"2023081805144569600_ref16","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s42400-018-0017-4","article-title":"Graph-based visual analytics for cyber threat intelligence","volume":"1","author":"B\u00f6hm","year":"2018","journal-title":"Cybersecurity"},{"key":"2023081805144569600_ref17","first-page":"1","volume-title":"International Symposium on Practical Aspects of Declarative Languages","author":"Balduccini","year":"2015"},{"key":"2023081805144569600_ref18","doi-asserted-by":"crossref","first-page":"755","DOI":"10.1145\/2976749.2978315","volume-title":"Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security","author":"Liao","year":"2016"},{"key":"2023081805144569600_ref19","doi-asserted-by":"crossref","first-page":"1798","DOI":"10.1109\/TPAMI.2013.50","article-title":"Representation learning: A review and new perspectives","volume":"35","author":"Bengio","year":"2013","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"2023081805144569600_ref20","first-page":"145","article-title":"Exploration of the working principle and application of word2vec","volume":"2","author":"Lian","year":"2015","journal-title":"Sci-Tech Information Development & Economy"},{"key":"2023081805144569600_ref21","first-page":"553","article-title":"Short-text semantic similarity using glove word embedding","volume":"6","author":"Hindocha","year":"2019","journal-title":"International Research Journal of Engineering and Technology"},{"key":"2023081805144569600_ref22","doi-asserted-by":"crossref","first-page":"102122","DOI":"10.1016\/j.ipm.2019.102122","article-title":"Towards a real-time processing framework based on improved distributed recurrent neural network variants with FastText for social big data analytics","volume":"57","author":"Hammou","year":"2020","journal-title":"Inf. Process. Manag."},{"key":"2023081805144569600_ref23","first-page":"241","volume-title":"23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020)","author":"Zhao","year":"2020"},{"key":"2023081805144569600_ref24","doi-asserted-by":"crossref","first-page":"132306","DOI":"10.1016\/j.physd.2019.132306","article-title":"Fundamentals of recurrent neural network (RNN) and long short-term memory (LSTM) network","volume":"404","author":"Sherstinsky","year":"2020","journal-title":"Physica D: Nonlinear Phenomena"},{"key":"2023081805144569600_ref25","doi-asserted-by":"crossref","first-page":"195","DOI":"10.1145\/1099554.1099591","volume-title":"Proceedings of the 14th ACM international conference on Information and knowledge management","author":"Ghamrawi","year":"2005"},{"key":"2023081805144569600_ref26","doi-asserted-by":"crossref","first-page":"325","DOI":"10.1016\/j.neucom.2019.01.078","article-title":"Bidirectional LSTM with attention mechanism and convolutional layer for text classification","volume":"337","author":"Liu","year":"2019","journal-title":"Neurocomputing"},{"key":"2023081805144569600_ref27","doi-asserted-by":"crossref","first-page":"101867","DOI":"10.1016\/j.cose.2020.101867","article-title":"Timiner: Automatically extracting and analyzing categorized cyber threat intelligence from social data","volume":"95","author":"Zhao","year":"2020","journal-title":"Computers and Security"},{"key":"2023081805144569600_ref28","first-page":"1","volume-title":"Proceedings of the IEEE conference on computer vision and pattern recognition","author":"Szegedy","year":"2015"},{"key":"2023081805144569600_ref29","doi-asserted-by":"crossref","first-page":"366","DOI":"10.1016\/j.neucom.2019.07.052","article-title":"Improving text classification with weighted word embeddings via a multi-channel TextCNN model","volume":"363","author":"Guo","year":"2019","journal-title":"Neurocomputing"},{"key":"2023081805144569600_ref30","first-page":"1","article-title":"HinCTI: A Cyber Threat Intelligence Modeling and Identification System Based on Heterogeneous Information Network","volume":"4347","author":"Gao","year":"2020","journal-title":"IEEE Transactions on Knowledge and Data Engineering"},{"key":"2023081805144569600_ref31","doi-asserted-by":"crossref","first-page":"325","DOI":"10.1016\/j.neucom.2019.01.078","article-title":"Bidirectional LSTM with attention mechanism and convolutional layer for text classification","volume":"337","author":"Liu","year":"2019","journal-title":"Neurocomputing"},{"key":"2023081805144569600_ref32","first-page":"1480","volume-title":"Proceedings of the 2016 conference of the North American chapter of the association for computational linguistics: human language technologies","author":"Yang","year":"2016"},{"key":"2023081805144569600_ref33","doi-asserted-by":"crossref","first-page":"259","DOI":"10.1162\/tacl_a_00097","article-title":"ABCNN: Attention-based convolutional neural network for modeling sentence pairs","volume":"4","author":"Yin","year":"2016","journal-title":"Transactions of the Association for Computational Linguistics"},{"key":"2023081805144569600_ref34","doi-asserted-by":"crossref","first-page":"377","DOI":"10.30630\/joiv.3.4.289","article-title":"Efficient processing of gru based on word embedding for text classification","volume":"3","author":"Zulqarnain","year":"2019","journal-title":"JOIV: International Journal on Informatics Visualization"},{"key":"2023081805144569600_ref35","first-page":"1","volume-title":"2019 International Joint Conference on Neural Networks (IJCNN)","author":"Wang","year":"2019"},{"key":"2023081805144569600_ref36","doi-asserted-by":"crossref","first-page":"667","DOI":"10.1007\/978-0-387-09823-4_34","volume-title":"Data mining and knowledge discovery handbook","author":"Tsoumakas","year":"2009"},{"key":"2023081805144569600_ref37","doi-asserted-by":"crossref","first-page":"1051","DOI":"10.1145\/3357384.3357885","volume-title":"Proceedings of the 28th ACM International Conference on Information and Knowledge Management","author":"Huang","year":"2019"}],"container-title":["The Computer Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/66\/8\/1870\/51107513\/bxac048.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/66\/8\/1870\/51107513\/bxac048.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,8,18]],"date-time":"2023-08-18T05:15:38Z","timestamp":1692335738000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/comjnl\/article\/66\/8\/1870\/6571525"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4,21]]},"references-count":37,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2022,4,21]]},"published-print":{"date-parts":[[2023,8,14]]}},"URL":"https:\/\/doi.org\/10.1093\/comjnl\/bxac048","relation":{},"ISSN":["0010-4620","1460-2067"],"issn-type":[{"value":"0010-4620","type":"print"},{"value":"1460-2067","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2023,8]]},"published":{"date-parts":[[2022,4,21]]}}}