Powered by OpenAIRE graph
Found an issue? Give us feedback
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/ ZENODOarrow_drop_down
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/
ZENODO
Dataset . 2025
License: CC BY
Data sources: ZENODO
ZENODO
Dataset . 2025
License: CC BY
Data sources: Datacite
ZENODO
Dataset . 2025
License: CC BY
Data sources: Datacite
versions View all 2 versions
addClaim

MITRE ATT&CK TTP Data Set

Authors: Hamzić, Dženan; Skopik, Florian; Landauer, Max; Wurzenberger, Markus;

MITRE ATT&CK TTP Data Set

Abstract

The dataset contains sentences from MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) along with their corresponding procedure descriptions. Here’s an overview: Columns: Key: Contains TTP techniques and subtechniques. Value: Contains the corresponding procedure descriptions. Data Details: The dataset has 19,747 rows, each representing a procedure linked to a TTP ID. It includes 780 unique TTP IDs covering both MITRE ATT&CK techniques and subtechniques. The TTPs and procedure descriptions were extracted from the enterprise-attack-15.1.json file available on GitHub. Preprocessing and Data Cleansing:The following regex rules were applied to the Value column: Replace URLs related to software with the term "Software":re.sub(r'[.?](https://attack\.mitre\.org/software/.?)', 'Software', text) Replace URLs related to groups with the term "Attacker":re.sub(r'[.?](https://attack\.mitre\.org/groups/.?)', 'Attacker', text) Remove any text within parentheses:str.replace(r'\([^)]*\)', '', regex=True) Remove any text within square brackets:str.replace(r'\[.*?\]', '', regex=True) Remove any leading or trailing whitespace:str.strip() Acknowledgments: Funded by the European Union under the European Defence Fund (GA no. 101121403 - NEWSROOM and GA no. 101121418 - EUCINF). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Commission. Neither the European Union nor the granting authority can be held responsible for them. This work is co-funded by the Austrian FFG Kiras project ASOC (GA no. FO999905301).

Related Organizations
Keywords

Threat Intelligence, Cybersecurity, MITRE ATT&CK, TTP, MITRE ATT&CK, Techniques

  • BIP!
    Impact byBIP!
    selected citations
    These citations are derived from selected sources.
    This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    0
    popularity
    This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
    Average
    influence
    This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    Average
    impulse
    This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
    Average
Powered by OpenAIRE graph
Found an issue? Give us feedback
selected citations
These citations are derived from selected sources.
This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Citations provided by BIP!
popularity
This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
BIP!Popularity provided by BIP!
influence
This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Influence provided by BIP!
impulse
This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
BIP!Impulse provided by BIP!
0
Average
Average
Average