Improving ML-based Solutions for Linking of CVE to MITRE ATT &CK Techniques
Saad El Jaouhari, Nouredine Tamani, Rohan Isaac Jacob · 2024
As our reliance on digital technologies continues to grow, so does the urgency of bolstering our cyber-defenses against the rising threats posed by malicious entities. Existing cybersecurity frameworks and databases such as MITRE ATT&CK and Common Vulnerabilities and Exposures (CVE) offer valuable insights that can assist in mitigating these threats effectively. However, the aforementioned CVE and MITRE ATT &CK solutions operate in silos. We argue that automatically linking the vulnerabilities listed in CVE database to MITRE ATT &CK adversarial techniques and tactics, and in particular the updated ones, will offer crucial and valuable information for blue teams seeking to enhance their cybersecurity defense against cyberattacks. The main objective of this paper is to offer a proactive insight into an attacker's next move by studying ex-isting ML/DL approaches developed to predicting the association between MITRE techniques and CVE in terms of reproducibility, performance analysis, and possible improvements. For the latter aspect, data augmentation and hyperparameter tuning techniques have been used and the obtained results showed significant improvements.