English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

The volume, variety, and velocity of change in vulnerabilities and exploitshave made incident threat analysis challenging with human expertise andexperience along. Tactics, Techniques, and Procedures (TTPs) are to describehow and why attackers exploit vulnerabilities. However, a TTP descriptionwritten by one security professional can be interpreted very differently byanother, leading to confusion in cybersecurity operations or even business,policy, and legal decisions. Meanwhile, advancements in AI have led to theincreasing use of Natural Language Processing (NLP) algorithms to assist thevarious tasks in cyber operations. With the rise of Large Language Models(LLMs), NLP tasks have significantly improved because of the LLM's semanticunderstanding and scalability. This leads us to question how well LLMs caninterpret TTPs or general cyberattack descriptions to inform analysts of theintended purposes of cyberattacks. We propose to analyze and compare the directuse of LLMs (e.g., GPT-3.5) versus supervised fine-tuning (SFT) ofsmall-scale-LLMs (e.g., BERT) to study their capabilities in predicting ATT&CKtactics. Our results reveal that the small-scale-LLMs with SFT provide a morefocused and clearer differentiation between the ATT&CK tactics (if suchdifferentiation exists). On the other hand, direct use of LLMs offer a broaderinterpretation of cyberattack techniques. When treating more general cases,despite the power of LLMs, inherent ambiguity exists and limits theirpredictive power. We then summarize the challenges and recommend researchdirections on LLMs to treat the inherent ambiguity of TTP descriptions used invarious cyber operations.

On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptions