English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Tactics, Techniques, and Procedures (TTPs) outline the methods attackers useto exploit vulnerabilities. The interpretation of TTPs in the MITRE ATT&CKframework can be challenging for cybersecurity practitioners due to presumedexpertise, complex dependencies, and inherent ambiguity. Meanwhile,advancements with Large Language Models (LLMs) have led to recent surge instudies exploring its uses in cybersecurity operations. This leads us toquestion how well encoder-only (e.g., RoBERTa) and decoder-only (e.g., GPT-3.5)LLMs can comprehend and summarize TTPs to inform analysts of the intendedpurposes (i.e., tactics) of a cyberattack procedure. The state-of-the-art LLMshave shown to be prone to hallucination by providing inaccurate information,which is problematic in critical domains like cybersecurity. Therefore, wepropose the use of Retrieval Augmented Generation (RAG) techniques to extractrelevant contexts for each cyberattack procedure for decoder-only LLMs (withoutfine-tuning). We further contrast such approach against supervised fine-tuning(SFT) of encoder-only LLMs. Our results reveal that both the direct-use ofdecoder-only LLMs (i.e., its pre-trained knowledge) and the SFT of encoder-onlyLLMs offer inaccurate interpretation of cyberattack procedures. Significantimprovements are shown when RAG is used for decoder-only LLMs, particularlywhen directly relevant context is found. This study further sheds insights onthe limitations and capabilities of using RAG for LLMs in interpreting TTPs.

Advancing TTP Analysis: Harnessing the Power of Encoder-Only and Decoder-Only Language Models with Retrieval Augmented Generation