Reports Classification by Adversarial Tactics and Techniques

A python tool to predict Att&ck tactics and techniques from cyber threat reports. ## Usage This tool is designed to predict tactics and techniques from the ATT&CK framework (https://attack.mitre.org/) in cyber threat reports, such as the ones that can be linked in https://otx.alienvault.com/ or https://exchange.xforce.ibmcloud.com/. rcATT is useable either by a command-line interface or a graphical interface. Both versions have the same functionalities:

• predict tactics and techniques from a given cyber threat reports in a text format
• order and visualize the confidence of the classifier for each techniques and tactics, even the one predicted as non-included in the report
• save results in a json file in a STIX format
• give feedbacks to the tool by modifying the prediction to positive or negative
• save the feedbacks and/or the results to the training set
• retrain the classifier with new data

Example of output STIX file

## Installation This tool requires:

• python >= 3.5
• joblib
• pandas
• numpy
• stix2
• scikit-learn
• nltk, and the following packages:
  • punkt
  • stopwords
  • wordnet
• flask (only for the GUI version)
• colorama (only for the command-line version)

Then simply download the tool and run that app file with python. ## How to use rcATT ### Command-line interface #### Predict tactics and techniques from a given cyber threat reports in a text format For the command line tool, save your report in a text file. Then use the command : python -p -i [report in a text file] The results will be displayed sorted by likelihood of presence.

#### Give feedbacks to the tool by modifying the prediction to positive or negative Use the command line: python app.py -f [list of tactics and techniques] -i [input a result .json file generated by rcATT] -o [output .json file] #### Save the feedbacks and/or the results to the training set Use the command python app.py -a -i [.json file provided by rcATT] #### Retrain the classifier with new data Use the command python app.py -t #### Save results in a json file in a STIX format In the command-line version, this step is included in the prediction or the feedback functionalities by adding an -o [output json file] to the command given. Precise a name and a date using -n [title of the report] and -d [date of publication]. ### Graphical interface #### Predict tactics and techniques from a given cyber threat reports in a text format Enter the report in the text area and click the "predict" button.

#### Give feedbacks to the tool by modifying the prediction to positive or negative Click the "Correct the results" button.

#### Save the feedbacks and/or the results to the training set Click the "Save the results for training" button. #### Retrain the classifier with new data Click the "⚙" button. #### Save results in a json file in a STIX format Click the "Export the results" button and fill in the form (if not filled in, default values will be given)

## More details Created by Valentine Legoy, during her Master thesis at the University of Twente, in partnership with Siemens. You can find more details on this work in the following paper: "Retrieving ATT&CK tactics and techniques in cyber threat repots".