APIRO：自动化安全工具框架API建议书
APIRO: A Framework for Automated Security Tools API Recommendation
摘要：
安全部署、自动化和响应（SOAR）平台集成并协调各种安全工具，以加速安全运营中心（SOC）的运营活动。SOAR平台中安全工具的集成主要是使用API、插件和脚本手动完成的。SOC团队需要浏览不同安全工具的API调用，以找到合适的API来定义或更新事件响应操作。分析具有不同API格式和表示结构的各种类型的API文档涉及重大挑战，例如数据可用性、数据异构性和语义变化，以自动识别特定于特定任务的安全工具API。鉴于这些挑战可能对SOC团队有效和高效地处理安全事件的能力产生负面影响，我们认为制定合适的自动化支持解决方案来应对这些挑战非常重要。我们提出了一种新的基于学习的自动化安全工具框架API推荐安全演示，自动化和响应，APIRO。为了缓解数据可用性约束，APIRO通过应用各种各样的数据增强技术来丰富安全工具API描述。为了了解安全工具的数据异构性和API描述中的语义变化，APIRO由特定于API的词嵌入模型和卷积神经网络（CNN）模型组成，用于预测任务的前3个相关API。我们通过实验证明了APIRO在使用3种安全工具和36种增强技术为不同任务推荐API方面的有效性。我们的实验结果表明，APIRO实现91.9%的Top-1准确度的可行性。
英文摘要：
Security Orchestration, Automation, and Response (SOAR) platforms integrate and orchestrate a wide variety of security tools to accelerate the operational activities of Security Operation Center (SOC). Integration of security tools in a SOAR platform is mostly done manually using APIs, plugins, and scripts. SOC teams need to navigate through API calls of different security tools to find a suitable API to define or update an incident response action. Analyzing various types of API documentation with diverse API format and presentation structure involves significant challenges such as data availability, data heterogeneity, and semantic variation for automatic identification of security tool APIs specific to a particular task. Given these challenges can have negative impact on SOC team's ability to handle security incident effectively and efficiently, we consider it important to devise suitable automated support solutions to address these challenges. We propose a novel learning-based framework for automated security tool API Recommendation for security Orchestration, automation, and response, APIRO. To mitigate data availability constraint, APIRO enriches security tool API description by applying a wide variety of data augmentation techniques. To learn data heterogeneity of the security tools and semantic variation in API descriptions, APIRO consists of an API-specific word embedding model and a Convolutional Neural Network (CNN) model that are used for prediction of top 3 relevant APIs for a task. We experimentally demonstrate the effectiveness of APIRO in recommending APIs for different tasks using 3 security tools and 36 augmentation techniques. Our experimental results demonstrate the feasibility of APIRO for achieving 91.9% Top-1 Accuracy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
