用Transformer模型自动预测网络攻击后果,准确率达97.2%。
The Application of Transformer-Based Models for Predicting Consequences of Cyber Attacks
- 结合BERT与层级注意力网络进行多标签分类
- 模型准确率97.2%,显著优于CNN和LSTM
- 适合安全团队快速评估攻击影响,提升响应效率
网络攻击日益增多,防御成本每年达数百亿美元。威胁建模通过理解攻击后果,为安全人员提供关键支持,助力及时应对与资源调配。本文利用自然语言处理与深度学习技术,基于MITRE CWE数据库的文本描述,分析网络攻击潜在影响。将攻击后果划分为五类:可用性、访问控制、机密性、完整性及其他。研究采用BERT结合层级注意力网络(HAN)进行多标签分类,并与传统CNN和LSTM模型对比。实验表明,BERT整体准确率达0.972,显著高于基线模型;在特定安全标签上,HAN表现优于CNN和LSTM;但BERT在精确率和召回率上持续领先,更适合预测攻击后果。
原文摘要 · Abstract (English)
Cyberattacks are increasing, and securing against such threats is costing industries billions of dollars annually. Threat Modeling, that is, comprehending the consequences of these attacks, can provide critical support to cybersecurity professionals, enabling them to take timely action and allocate resources that could be used elsewhere. Cybersecurity is heavily dependent on threat modeling, as it assists security experts in assessing and mitigating risks related to identifying vulnerabilities and threats. Recently, there has been a pressing need for automated methods to assess attack descriptions and forecast the future consequences of the increasing complexity of cyberattacks. This study examines how Natural Language Processing (NLP) and deep learning can be applied to analyze the potential impact of cyberattacks by leveraging textual descriptions from the MITRE Common Weakness Enumeration (CWE) database. We emphasize classifying attack consequences into five principal categories: Availability, Access Control, Confidentiality, Integrity, and Other. This paper investigates the use of Bidirectional Encoder Representations from Transformers (BERT) in combination with Hierarchical Attention Networks (HANs) for Multi-label classification, evaluating their performance in comparison with conventional CNN and LSTM-based models. Experimental findings show that BERT achieves an overall accuracy of $0.972$, far higher than conventional deep learning models in multi-label classification. HAN outperforms baseline forms of CNN and LSTM-based models on specific cybersecurity labels. However, BERT consistently achieves better precision and recall, making it more suitable for predicting the consequences of a cyberattack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。