Inferring Recovery Steps from Cyber Threat Intelligence Reports

Within the constantly changing threat landscape, Security Operation Centers are overwhelmed by suspicious alerts, which require manual investigation. Nonetheless, given the impact and severity of modern threats, it is crucial to quickly mitigate and respond to potential incidents. Currently, security operators use predefined sets of actions from so-called playbooks to respond to incidents. However, these playbooks need to be manually created and updated for each threat, again increasing the workload of the operators. In this work, we research approaches to automate the inference of recovery steps by automatically identifying steps taken by threat actors within Cyber Threat Intelligence reports and translating these steps into recovery steps that can be def ined in playbooks. Our insight is that by analyzing the text describing threats, we can effectively infer their corresponding recovery actions. To this end, we first design and implement a semantic approach based on traditional Natural Language Processing techniques, and we then study a generative approach based on recent Large Language Models (LLMs). Our experiments show that even if the LLMs were not designed to solve domain-specific problems, they outperform the precision of semantic approaches by up to 45%. We also evaluate factuality showing that LLMs tend to produce up to 90 factual errors over the entire dataset

Comparing two- and three-view computer vision

To reconstruct the points in three dimensional space, we need at least two images. In this paper we compared two different methods: the first uses only two images, the second one uses three. During the research we measured how camera resolution, camera angles and camera distances influence the number of reconstructed points and the dispersion of them. The paper presents that using the two-view method, we can reconstruct significantly more points than using the other one, but the dispersion of points is smaller if we use the three-view method. Taking into consideration the different camera settings, we can say that both the two- and three-view method behaves the same, and the best parameters are also the same for both methods