Table 13 Ablation experiments on the phishing TTP
From: TIM: threat context-enhanced TTP intelligence mining on unstructured threat data
Model | Component | Precision | Recall | F1 |
|---|---|---|---|---|
Only TTPs Elms. | CNN | 0.566 | 0.497 | 0.339 |
TCENet w/o Elms. with CNN | Sentence-BERT + CNN | 0.915 | 0.954 | 0.934 |
TCENet w/o Elms. with BiLSTM. | Sentence-BERT + BiLSTM | 0.941 | 0.950 | 0.945 |
TCENet with FC_E | Sentence-BERT + FC + BiLSTM | 0.940 | 0.965 | 0.952 |
TCENet with FC_C | Sentence-BERT + CNN + FC | 0.949 | 0.953 | 0.951 |
TCENet | Sentence-BERT + CNN + BiLSTM | 0.970 | 0.973 | 0.971 |