Network Security Situational Assessment Based on the ATT&CK Tactics Framework and Transformer Model

This paper proposes a network security situational assessment method based on the ATT&CK tactics framework and the Transformer model, aiming to provide a comprehensive and effective way to analyze and evaluate security threats and risks in networks. Traditional methods of cybersecurity situational assessment use expert indicator systems to evaluate the security situation in networks based on rules and functions. However, their effectiveness is limited by static indicator systems and function fitting based on expert experience. However, traditional methods have become less flexible and comprehensive as threats continue to evolve and new attack techniques emerge. Therefore, to address these limitations, we introduce the ATT&CK tactics framework as a key reference for cybersecurity situational assessment. The ATT&CK tactics framework provides a comprehensive and structured threat knowledge base for describing and categorizing attacker tactics, techniques, and procedures. At the same time, we leverage the powerful capabilities of the Transformer model to handle complex information in cybersecurity situational assessment. Compared to traditional sequential models such as RNN and LSTM, the Transformer model can better extract the correlation of different time network data. Its Self-Attention mechanism and parallel computing capabilities enable it to perform fine-grained modeling and analysis on sequential data. During the experimental evaluation, we conducted testing and validation of the developed cybersecurity situational assessment model. The experimental results demonstrate that the proposed model is more accurate and comprehensive than traditional methods. Additionally, we demonstrate the applicability and flexibility of the model in different datasets.On two different datasets, precision rates of 96.77% and 94.65% were achieved respectively.