论文标题
多级微调，数据增强和用于专业的网络威胁智能的几乎没有记录的学习
Multi-Level Fine-Tuning, Data Augmentation, and Few-Shot Learning for Specialized Cyber Threat Intelligence
论文作者
论文摘要
随着系统变得更大，更复杂，从开源的收集网络威胁智能对于维持和实现高水平的安全性变得越来越重要。但是，这些开源通常会受到信息过载的约束。因此，应用机器学习模型将信息量凝结到必要的内容很有用。但是，以前的研究和应用表明，由于其概括能力低，现有的分类器无法提取有关新兴网络安全事件的特定信息。因此，我们建议通过为每个新事件培训新的分类器来克服这个问题的系统。由于这需要使用标准培训方法进行大量标记的数据，因此我们结合了三种不同的低数据制度技术 - 转移学习，数据增强和很少的学习学习 - 从很少的标记实例中训练高质量的分类器。我们使用来自2021年的Microsoft Exchange Server数据泄露的新型数据集评估了我们的方法，该数据集由三名专家标记。与标准培训方法相比，与标准训练方法相比，与标准训练方法相比，与先进的方法相比，F1得分的增加超过21分，而在几次学习中的最新方法中的提高。此外，经过此方法培训的分类器和32个实例的分类器仅比接受1800个实例的分类器少于5 F1分数。
Gathering cyber threat intelligence from open sources is becoming increasingly important for maintaining and achieving a high level of security as systems become larger and more complex. However, these open sources are often subject to information overload. It is therefore useful to apply machine learning models that condense the amount of information to what is necessary. Yet, previous studies and applications have shown that existing classifiers are not able to extract specific information about emerging cybersecurity events due to their low generalization ability. Therefore, we propose a system to overcome this problem by training a new classifier for each new incident. Since this requires a lot of labelled data using standard training methods, we combine three different low-data regime techniques - transfer learning, data augmentation, and few-shot learning - to train a high-quality classifier from very few labelled instances. We evaluated our approach using a novel dataset derived from the Microsoft Exchange Server data breach of 2021 which was labelled by three experts. Our findings reveal an increase in F1 score of more than 21 points compared to standard training methods and more than 18 points compared to a state-of-the-art method in few-shot learning. Furthermore, the classifier trained with this method and 32 instances is only less than 5 F1 score points worse than a classifier trained with 1800 instances.
