标题： 规则-ATT&CK映射器（RAM）：使用LLMs将SIEM规则映射到TTPs 显示英文标题

标题： Rule-ATT&CK Mapper (RAM): Mapping SIEM Rules to TTPs Using LLMs

摘要： 日益增加的网络攻击频率提高了对准确且高效的威胁检测系统的需求。 SIEM平台对于分析日志数据并通过基于规则的查询（也称为SIEM规则）检测对抗性活动非常重要。 威胁分析过程的效率在很大程度上依赖于将这些SIEM规则映射到MITRE ATT&CK框架中的相关攻击技术。 SIEM规则的不准确标注可能导致对攻击的误解，增加遗漏威胁的可能性。 现有的将SIEM规则与MITRE ATT&CK技术标签进行标注的解决方案存在显著的局限性：手动标注SIEM规则既耗时又容易出错，而基于机器学习的方法主要专注于标注非结构化自由文本源，而不是像SIEM规则这样的结构化数据。 结构化数据通常包含的信息有限，进一步使标注过程复杂化，使其成为一个具有挑战性的任务。 为了解决这些挑战，我们提出了Rule-ATT&CK Mapper（RAM），这是一种新颖的框架，利用大语言模型（LLMs）自动化将结构化的SIEM规则映射到MITRE ATT&CK技术。 RAM的多阶段流程受到提示链技术的启发，可以在不需要LLM预训练或微调的情况下提高映射准确性。 使用Splunk Security Content数据集，我们使用几种LLM，包括GPT-4-Turbo、Qwen、IBM Granite和Mistral来评估RAM的性能。 我们的评估突出了GPT-4-Turbo的优越性能，这源于其丰富的知识库，而消融研究强调了外部上下文知识在克服LLM隐式知识在特定领域任务中的局限性中的重要性。 这些发现表明RAM在自动化网络安全工作流方面的潜力，并为此领域的未来进步提供了有价值的见解。 显示英文摘要

摘要： The growing frequency of cyberattacks has heightened the demand for accurate and efficient threat detection systems. SIEM platforms are important for analyzing log data and detecting adversarial activities through rule-based queries, also known as SIEM rules. The efficiency of the threat analysis process relies heavily on mapping these SIEM rules to the relevant attack techniques in the MITRE ATT&CK framework. Inaccurate annotation of SIEM rules can result in the misinterpretation of attacks, increasing the likelihood that threats will be overlooked. Existing solutions for annotating SIEM rules with MITRE ATT&CK technique labels have notable limitations: manual annotation of SIEM rules is both time-consuming and prone to errors, and ML-based approaches mainly focus on annotating unstructured free text sources rather than structured data like SIEM rules. Structured data often contains limited information, further complicating the annotation process and making it a challenging task. To address these challenges, we propose Rule-ATT&CK Mapper (RAM), a novel framework that leverages LLMs to automate the mapping of structured SIEM rules to MITRE ATT&CK techniques. RAM's multi-stage pipeline, which was inspired by the prompt chaining technique, enhances mapping accuracy without requiring LLM pre-training or fine-tuning. Using the Splunk Security Content dataset, we evaluate RAM's performance using several LLMs, including GPT-4-Turbo, Qwen, IBM Granite, and Mistral. Our evaluation highlights GPT-4-Turbo's superior performance, which derives from its enriched knowledge base, and an ablation study emphasizes the importance of external contextual knowledge in overcoming the limitations of LLMs' implicit knowledge for domain-specific tasks. These findings demonstrate RAM's potential in automating cybersecurity workflows and provide valuable insights for future advancements in this field.