A BERT-Based Framework for Automated Extraction of Behavioral Indicators of Compromise from Security Incident Reports

The exponential growth of cyberattacks in recent years has highlighted the inadequacy of existing detection mechanisms and therefore the need to develop more relevant predictive models and methods in the field of Cyber Threat Intelligence (CTI). Many cybersecurity systems use behavioral indicators of compromise (IoCs), such as tactics, techniques, and procedures (TTPs), to design their defense strategies and detect future attacks attempts in an early stage. Typically, behavioral IoCs are gathered from unstructured incident reports, often written in natural language, and are typically extracted with manual analysis by cybersecurity experts. However, due to the huge number of reports daily released, this task has become more difficult and time-consuming to make it effective. In this paper, we propose a framework based on Bidirectional Encoder Representations from Transformers (BERT) to identify and recognize behavioral IoCs in incident reports. The results of our contribution showed a significant improvement of the F1-score compared to the state-of-the-art works.