Deep Security Detection Framework Based on ATT&CK

Rixuan Qiu ； Yu Fu ； Jian Le ； Fuyong Zheng ； Gan Qi ； Chao Peng ； Yi Zhang ； Yuancheng Li ； Yan Liu

《International Journal of Network Security》 25卷1期 (2023/01) Pp. 161-170

https://doi.org/10.6633/IJNS.202301_25(1).18

摘要

It is urgent to establish an efficient and comprehensive security system architecture facing the increasingly severe network threat. Aiming at the security problems in information systems, a deep security detection framework based on ATT&CK is proposed. There are three modules: information collection, analysis engine, and security response. The anomaly detection results of the technical layer based on ATT&CK knowledge base association analysis are mapped to the attack links of the tactical layer, thus realizing the bottom-up system security detection. An improved transformer anomaly detection method based on FLOATER positional coding is applied in the security detection framework to realize the early detection of network threats. Based on the continuous dynamic system, the positional coding function is learned to capture the temporal features of the sequence. Then multi-head attention is used to encode the input sequence. Moreover, the model training is optimized by the adversarial method. The experimental results demonstrated that the method applied in this work outperforms traditional deep learning models in terms of detection accuracy and F1 score.

關鍵字

Anomaly Detection ； ATT&CK ； Security Architecture ； System Security ； Transformer