Extraction of Threat Actions from Threat-related Articles using Multi-Label Machine Learning Classification Method

With the rapid development of open source threat intelligence, researchers are sharing threat-related articles through blog articles or reports. The shared information, like IoC and threat action, can promote defense ability against the potential threats. However, with high columns of threat-related articles published, extracting threat-related information from unstructured context, especially threat action, has become a challenge. To overcome this problem, we present a method to extract threat action from threat-related articles. Firstly, topics are indexed with latent semantic indexing method. Next, with ATT&CK as taxonomy, semantic similarities are computed as classification features. Finally, a multi-label classification model extracts threat actions from threat-related articles. To evaluate our method, a labelled APT group-related dataset is collected and shared. The result shows, the maximum precision, recall ratio and F-1 measure for multi-label classification are 59.50%, 69.86% and 56.96%. Our method can help researcher understand network situation and make proactive defense measures against potential threats.