The increasingly sophisticated and growing number of threat actors along with
the sheer speed at which cyber attacks unfold, make timely identification of
attacks imperative to an organisations' security. Consequently, persons
responsible for security employ a large variety of information sources
concerning emerging attacks, attackers' course of actions or indicators of
compromise. However, a vast amount of the needed security information is
available in unstructured textual form, which complicates the automated and
timely extraction of attackers' Tactics, Techniques and Procedures (TTPs). In
order to address this problem we systematically evaluate and compare different
Natural Language Processing (NLP) and machine learning techniques used for
security information extraction in research. Based on our investigations we
propose a data processing pipeline that automatically classifies unstructured
text according to attackers' tactics and techniques derived from a knowledge
base of adversary tactics, techniques and procedures.