Tactics, Techniques and Procedures (TTPs) represent sophisticated attack patterns in the cybersecurity domain, described encyclopedically in textual knowledge bases. Identifying TTPs in cybersecurity writing, often called *TTP mapping*, is an important and challenging task. Conventional learning approaches often target the problem in the classical multi-class or multi-label classification setting. This setting hinders the learning ability of the model due to a large number of classes (i.e., TTPs), the inevitable skewness of the label distribution and the complex hierarchical structure of the label space. We formulate the problem in a different learning paradigm, where the assignment of a text to a TTP label is decided by the direct semantic similarity between the two, thus reducing the complexity of competing solely over the large labeling space. To that end, we propose a neural matching architecture with a sampling-based learn-to-compare mechanism and two complementary sampled objectives: $α$-balanced NCE controls the collective mass, but not the internal ordering, of sampled negatives; asymmetric focusing controls individual comparisons under incomplete annotation.

翻译：暂无翻译