Mapping Exploit Code on Paste Sites to the MITRE ATT&CK Framework: A Multi-label Transformer Approach

Benjamin M. Ampel, Tala Vahedi, Sagar Samtani, Hsinchun Chen
Last updated on Jun 9, 2026
PDF DOI
In Plain Terms

This study automatically analyzes malicious code posted on public paste sites like Pastebin and maps it to MITRE ATT&CK, a standard catalog of attacker techniques, to produce early cyber threat intelligence. It introduces a hybrid deep-learning model (combining convolutional, Transformer, and BiLSTM components) that can assign multiple technique labels to each code snippet. The model set new best-in-class performance, and a case study revealed the tactics and tools attackers share on these sites.

Artifacts

PDF DOI

Related Papers

Cite this

APA Ampel, B. M., Vahedi, T., Samtani, S., & Chen, H. (2023). Mapping Exploit Code on Paste Sites to the MITRE ATT&CK Framework: A Multi-label Transformer Approach. In 2023 IEEE International Conference on Intelligence and Security Informatics (ISI). https://doi.org/10.1109/ISI58743.2023.10297272
BibTeX
@inproceedings{ampel2023mapping,
  title={Mapping Exploit Code on Paste Sites to the MITRE ATT&CK Framework: A Multi-label Transformer Approach},
  author={Benjamin M. Ampel and Tala Vahedi and Sagar Samtani and Hsinchun Chen},
  booktitle={2023 IEEE International Conference on Intelligence and Security Informatics (ISI)},
  year={2023},
  doi={10.1109/ISI58743.2023.10297272}
}
Cyber Threat Intelligence MITRE ATT&CK Deep Learning Paste Sites Exploit Analysis
Benjamin M. Ampel

Benjamin M. Ampel

Assistant Professor in Computer Information Systems and Director, Center for CyberAI Research (CCAIR)

My research focuses on AI-enabled Cybersecurity, including Cyber Threat Intelligence, Large Language Models, and Phishing Detection.