Making Sense of Unstructured Threat Data
summary
Trains Word2Vec/Doc2Vec on open-source reports from EU-CERT and US-CERT plus CVE text from NVD, then clusters document vectors to link vulnerability descriptions to MITRE ATT&CK techniques. Uses a distributed bag-of-words Doc2Vec variant, creates ~100 natural clusters from ~100k CVEs, and achieves roughly 50% accuracy at matching techniques versus a 1% random baseline. Demonstrates DLL hijacking and browser-vulnerability clusters as concrete examples and publishes code on GitHub under Word2Vec.
AI-written summary · about
chapters (11)
- 0:00Introduction to talk
- 1:49Connecting threat data sources
- 5:00NLP with Word2Vec
- 7:54Doc2Vec for documents
- 8:36Processing datasets
- 9:20CVE clustering results
- 10:23Linking techniques to CVEs
- 11:27Demo and repository overview
- 13:18Evaluating model accuracy
- 15:44Practical security benefits
- 16:50Q&A session
related talks
30mBoosting Vulnerability Intelligence: How Accurate CWE Mappings Transform ML Model Performance
26mImproving Cybersecurity Posture with an AI Security Assistant
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
21mState of Attack Surface Elimination in a World Plagued by Vulnerable Software
42mKeynote: The Expanding Universe of Cyber Threats
31mValidating Vulnerability Analysis with Statistical Analysis of Metadata
44mUnmasking APTs: An Automated Approach for Real-World Threat Attribution
33mWhere is my Code Vulnerable: Matching CVEs and Source Code