Towards Enhanced Detection of Website Defacement: A Hybrid Model Combining Transformer NLP and MITRE ATT&CK TTPs

Website defacement is a rising cybersecurity threat, often classified as cyber vandalism.These attacks disrupt operations, damage reputation, and cause data loss.Few studies examine advanced models like the Transformer for analyzing defacement content.However, there are some shortcomings, particularly in the diversity and representativeness of the datasets used, which often fail to capture real-world defacement scenarios.This research introduces a hybrid approach that combines fine-tuned BERT for textual defacement detection with the MITRE ATT&CK framework to map observed defacement patterns to known adversarial tactics, techniques, and procedures (TTPs).The dataset comprises defaced pages from ZoneXsec and normal pages from Webometrics and Tranco, ensuring diversity and real-world relevance.It presents a fine-tuned BERT model to detect defacement, leveraging its deep semantic understanding.Results show Fine-Tuning BERT achieves 98.770% accuracy, 99.060% precision, 96.460% recall, and a 97.743% F1-score, with unfreezing parameters enhancing generalization.The Random Forest (RF), Decision Tree (DT), K-Nearest Neighbor (KNN) model performs slightly worse, while other models like Naïve Bayes (NB) underperform.These findings emphasize deep learning's strength, especially Transformer architectures, in cybersecurity text analysis.The study could support automated, scalable systems for early defacement detection, reducing response time and reputational harm.