Clustering doc2vec output for topic-dimensionality reduction: A MITRE ATT&CK calibration

TL;DR

This paper presents a novel method combining doc2vec embeddings with clustering algorithms, especially Louvain, to improve topic modeling and dimensionality reduction in cybersecurity text analysis using the MITRE ATT&CK framework.

Contribution

It introduces an innovative combination of embedding and clustering techniques for high-dimensional text data, applied specifically to cybersecurity risk analysis.

Findings

Louvain clustering outperformed other methods in coherence and efficiency.

The approach identified four super tactics, enhancing thematic understanding.

Results support the effectiveness of clustering-enhanced topic modeling.

Abstract

We introduce a novel approach to text classification by combining doc2vec embeddings with advanced clustering techniques to improve the analysis of specialized, high-dimensional textual data. We integrate unsupervised methods such as Louvain, K-means, and Spectral clustering with doc2vec to enhance the detection of semantic patterns across a large corpus. As a case study, we apply this methodology to cybersecurity risk analysis using the MITRE ATT\&CK framework to structure and reduce the dimensionality of cyberattack tactics. Louvain clustering proved the most effective among the tested methods, achieving the best balance between cluster coherence and computational efficiency. Our approach identifies four "super tactics," demonstrating how clustering improves thematic coherence and risk attribution. The results validate the utility of combining doc2vec with clustering, particularly Louvain, for enhancing topic modeling and text classification.