When Knowledge Graph Meets TTPs: Automated & Adaptive Executable TTP Intelligence for Security
summary
Builds a TTP Knowledge Graph from automated extraction of reports using Transformer models with Chinese word tokenization and three optimizations (primary vs secondary technique labeling, object-centric NER, sliding-window fine tuning) and links techniques, assets, permissions and playbooks. A rule + logic hybrid engine applies an adapted MITRE ATT&CK, permission-aware reasoning and incremental caching to generate adaptive attack chains; demoed live playbooks that obtain user then system credentials and returns simulation results in roughly 30 seconds.
AI-written summary · about
chapters (11)
- 0:00Knowledge Graph & TTPs intro
- 1:29TTP intelligence challenges
- 2:34Traditional TTP extraction limits
- 5:30ML for optimized TTP extraction
- 6:33TTP Knowledge Graph structure
- 9:54Adaptive attack path reasoning
- 17:29Real-world attack pattern reasoning
- 24:51Tech stack & system implementation
- 26:13Demo: automated TTP extraction
- 37:21Key takeaways & future plans
- 38:46Q&A on data quality
related talks
39mThe PR3TACK Initiative: Building the World’s First Preemptive Tactics & Countermeasures Knowledgebas
34mThere is No TTP
16mSoK: Automated TTP Extraction from CTI Reports – Are We There Yet?
23mData Driven APT Attribution and AI/ML Research
26mDeath to the IOC: What's Next in Threat Intelligence
13mAPTGen: An Approach towards Generating Practical Dataset Labelled with Targeted...
25mAttack, Defense & Danger in the Age of AI
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful