https://github.com/center-for-threat-informed-defense/technique-inference-engine

TIE is a machine learning model for inferring associated MITRE ATT&CK techniques from previously observed techniques.
https://github.com/center-for-threat-informed-defense/technique-inference-engine

ctid cyber-threat-intelligence cybersecurity machine-learning mitre-attack threat-informed-dense

Last synced: 6 months ago
JSON representation

TIE is a machine learning model for inferring associated MITRE ATT&CK techniques from previously observed techniques.

• Host: GitHub
• URL: https://github.com/center-for-threat-informed-defense/technique-inference-engine
• Owner: center-for-threat-informed-defense
• License: apache-2.0
• Created: 2023-10-12T16:03:56.000Z (almost 2 years ago)
• Default Branch: main
• Last Pushed: 2025-03-19T20:16:56.000Z (7 months ago)
• Last Synced: 2025-03-26T08:47:33.399Z (7 months ago)
• Topics: ctid, cyber-threat-intelligence, cybersecurity, machine-learning, mitre-attack, threat-informed-dense
• Language: TypeScript
• Homepage: https://ctid.io/tie
• Size: 12.6 MB
• Stars: 48
• Watchers: 46
• Forks: 6
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • Contributing: CONTRIBUTING.md
  • License: LICENSE.txt

Awesome Lists containing this project

README

          
[![MITRE ATT&CK® v15](https://img.shields.io/badge/MITRE%20ATT%26CK®-v15-red)](https://attack.mitre.org/versions/v15/)

# Technique Inference Engine

The Technique Inference Engine (TIE) allows cyber defenders to forecast an adversary's

next steps by predicting associated [MITRE ATT&CK](<(https://attack.mitre.org/)>)

techniques from previously observed techniques. TIE enables defenders to build a

complete picture of an adversary and their actions. TIE also offers one of the largest

publicly available datasets of its kind, linking CTI Reports to ATT&CK Techniques. The

dataset includes 43,899 technique observations across 6,236 CTI Reports, achieving 96%

coverage of ATT&CK Enterprise v15.0. This project is created and maintained by the

[MITRE Center for Threat-Informed

Defense](https://ctid.mitre.org/)

in furtherance of our mission to advance the start of the art and the state of the

practice in threat-informed defense globally. The project is funded by our research

participants.

**Table Of Contents:**

- [Getting Started](#getting-started)

- [Getting Involved](#getting-involved)

- [Questions and Feedback](#questions-and-feedback)

- [Notice](#notice)

## Getting Started

To get started, we suggest visiting the project website, reading about the project, and

experimenting with the Engine. For machine learning engineers, you may want to try

training your own models using the Python notebook and/or training data.

| Resource                                                                                                                                    | Description                                                                  |

| ------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |

| [Technique Inference Engine (Website)](https://center-for-threat-informed-defense.github.io/technique-inference-engine/)                    | Learn about the project and run TIE right in your browser.                   |

| [Technique Inference Engine (Python Notebook)](https://center-for-threat-informed-defense.github.io/technique-inference-engine/#/resources) | Run TIE locally and modify the code or training data to build custom models. |

| [Training Data](https://github.com/center-for-threat-informed-defense/technique-inference-engine/tree/main/data)                            | Access the CTI Data used to train TIE.                                       |

## Getting Involved

There are several ways that you can get involved with this project and help

advance threat-informed defense:

- **Visit the Technique Inference Engine website.** Use the website to learn how the Engine works and make your own predictions.

- **Train your own Engine.** Train the Technique Inference Engine on your own CTI data using the official Python Notebook.

- **Contribute your own CTI.** We are interested in further expanding the Engine's dataset. If you have your own CTI you'd like to share, we would welcome your contribution.

## Questions and Feedback

We welcome your feedback and contributions to help advance

Technique Inference Engine. Please see the guidance for contributors if are you

interested in [contributing or simply reporting issues.](/CONTRIBUTING.md)

Please submit

[issues](https://github.com/center-for-threat-informed-defense/technique-inference-engine/issues) for

any technical questions/concerns or contact

[ctid@mitre.org](mailto:ctid@mitre.org?subject=subject=Question%20about%20technique-inference-engine)

directly for more general inquiries.

## Notice

Copyright 2024 MITRE. Approved for public release. Document number CT0124.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this

file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under

the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

KIND, either express or implied. See the License for the specific language governing

permissions and limitations under the License.