Skip to content
/ rcATT Public

A python app to predict Att&ck tactics and techniques from cyber threat reports

License

Notifications You must be signed in to change notification settings

vlegoy/rcATT

Repository files navigation

rcATT logo

Reports Classification by Adversarial Tactics and Techniques

made with python license MIT

A python tool to predict Att&ck tactics and techniques from cyber threat reports.

Usage

This tool is designed to predict tactics and techniques from the ATT&CK framework (https://attack.mitre.org/) in cyber threat reports, such as the ones that can be linked in https://otx.alienvault.com/ or https://exchange.xforce.ibmcloud.com/.

rcATT is useable either by a command-line interface or a graphical interface. Both versions have the same functionalities:

  • predict tactics and techniques from a given cyber threat reports in a text format
  • order and visualize the confidence of the classifier for each techniques and tactics, even the one predicted as non-included in the report
  • save results in a json file in a STIX format
  • give feedbacks to the tool by modifying the prediction to positive or negative
  • save the feedbacks and/or the results to the training set
  • retrain the classifier with new data

rcATT stix ouput
Example of output STIX file

Installation

This tool requires:

Then simply download the tool and run that app file with python.

How to use rcATT

Command-line interface

Predict tactics and techniques from a given cyber threat reports in a text format

For the command line tool, save your report in a text file. Then use the command : python -p -i [report in a text file]

The results will be displayed sorted by likelihood of presence.

rcATT command-line help rcATT command-line results

Give feedbacks to the tool by modifying the prediction to positive or negative

Use the command line: python app.py -f [list of tactics and techniques] -i [input a result .json file generated by rcATT] -o [output .json file]

Save the feedbacks and/or the results to the training set

Use the command python app.py -a -i [.json file provided by rcATT]

Retrain the classifier with new data

Use the command python app.py -t

Save results in a json file in a STIX format

In the command-line version, this step is included in the prediction or the feedback functionalities by adding an -o [output json file] to the command given. Precise a name and a date using -n [title of the report] and -d [date of publication].

Graphical interface

Predict tactics and techniques from a given cyber threat reports in a text format

Enter the report in the text area and click the "predict" button.

rcATT GUI

Give feedbacks to the tool by modifying the prediction to positive or negative

Click the "Correct the results" button.

rcATT change results

Save the feedbacks and/or the results to the training set

Click the "Save the results for training" button.

Retrain the classifier with new data

Click the "⚙" button.

Save results in a json file in a STIX format

Click the "Export the results" button and fill in the form (if not filled in, default values will be given)

rcATT save in stix

More details

Created by Valentine Legoy, during her Master thesis at the University of Twente, in partnership with Siemens. You can find more details on this work in the following paper: "Retrieving ATT&CK tactics and techniques in cyber threat repots".

About

A python app to predict Att&ck tactics and techniques from cyber threat reports

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published