Create Training Data and Build Initial Machine Learning Models for DISARM Red Framework TTPs

[KadeMorton]

Description

To support the integration of the DISARM Red Framework within Thread, we need to create training data and build initial machine learning models for each TTP (Tactics, Techniques, and Procedures) in the framework. This task involves gathering relevant training data, developing models, and validating their performance to ensure they accurately map TTPs in the context of the DISARM Red Framework.

Task

• Gather and Curate Training Data: Collect and curate relevant training data that accurately represents each TTP in the DISARM Red Framework. This may involve sourcing data from existing datasets or manually annotating reports.
• Build Initial Machine Learning Models: Develop machine learning models for each TTP based on the curated training data. Ensure that each model is tailored to effectively identify and categorize the specific TTP it represents.
• Model Validation and Tuning: Validate the initial models using a separate test dataset. Adjust and tune the models as necessary to improve accuracy and reduce false positives/negatives.
• Document the Model Development Process: Keep records of the training data, model configurations, and validation results. This documentation will be critical for future model improvements and troubleshooting.

Acceptance Criteria

• Successful creation of training data that accurately represents the TTPs in the DISARM Red Framework.
• Development of initial machine learning models for each TTP, with all models performing at an acceptable level of accuracy.
• Completion of a validation process that confirms the models' effectiveness in identifying and categorizing TTPs.
• Documentation of the entire model development process, including data sources, model configurations, and validation results.

Steps

1. Training Data Collection and Curation: Complete data collection and curation.
2. Model Development: Develop the initial machine learning models, based on the curated data.
3. Validation and Tuning: Validate and tune the models to ensure they meet accuracy standards.
4. Documentation and Review: Document the process and conduct a review post-validation.