  Tactics, Techniques and Procedures (TTPs) represent sophisticated attack
patterns in the cybersecurity domain, described encyclopedically in textual
knowledge bases. Identifying TTPs in cybersecurity writing, often called TTP
mapping, is an important and challenging task. Conventional learning approaches
often target the problem in the classical multi-class or multilabel
classification setting. This setting hinders the learning ability of the model
due to a large number of classes (i.e., TTPs), the inevitable skewness of the
label distribution and the complex hierarchical structure of the label space.
We formulate the problem in a different learning paradigm, where the assignment
of a text to a TTP label is decided by the direct semantic similarity between
the two, thus reducing the complexity of competing solely over the large
labeling space. To that end, we propose a neural matching architecture with an
effective sampling-based learn-to-compare mechanism, facilitating the learning
process of the matching model despite constrained resources.
