Learning the Associations of MITRE ATT&CK Adversarial Techniques

Abstract

The MITRE ATT&CK Framework provides a rich and actionable repository of adversarial tactics, techniques, and procedures (TTP). However, this information would be highly useful for attack diagnosis (i.e., forensics) and mitigation (i.e., intrusion response) if we can reliably construct technique associations that will enable predicting unobserved attack techniques based on observed ones. In this paper, we present our statistical machine learning analysis on APT and Software attack data reported by MITRE ATT&CK to infer the technique clustering that represents the significant correlation that can be used for technique prediction. Due to the complex multidimensional relationships between techniques, many of the traditional clustering methods could not obtain usable associations. Our approach, using hierarchical clustering for inferring attack technique associations with 95% confidence, provides statistically significant and explainable technique correlations. Our analysis discovers 98 different technique associations (i.e., clusters) for both APT and Software attacks. Our evaluation results show that 78% of the techniques associated by our algorithm exhibit significant mutual information that indicates reasonably high predictability.

A lightweight framework for cyber risk management in Western Balkan higher education institutions

“…These systems comprise stored data, including student and lecturer profile pages, functionalities for the management of files through downloading and uploading various documents, and virtual learning-relevant forum pages. The present research employs a qualitative and descriptive methodology ( Invicti, 2021 ) based on penetration testing techniques ( Al-Shaer, Spring & Christou, 2020 ; Korniyenko et al, 2021 ; The MITRE Corporation, 2021 ; OWASP, 2021b ; Yosifova, 2021 ) to identify essential vulnerabilities in eLMS in Western Balkan HEIs. The primary objective is to discern critical vulnerabilities within eLMSs in HEIs situated in the Western Balkan region.…”

“…The process of penetration testing ( Zakaria et al, 2019 ) involves passive analysis of eLMS for weaknesses, technical flaws, or vulnerabilities. According to MITRE ATT&CK and OWASP ( Al-Shaer, Spring & Christou, 2020 ; Korniyenko et al, 2021 ; Pham & Dang, 2018 ; Zare, Zare & Azadi, 2018 ), the primary purpose of penetration tests is to find more effective attack vectors as well as exploit vulnerabilities.…”

Analysis of Cyber-Intelligence Frameworks for AI Data Processing

“…Currently, there is a scarcity of research focused on the use of AI in the Mitre Att&ck model. The most relevant is likely the study conducted in [29], which applied clustering algorithms to determine possible associations of TTPs. On the other hand, and beyond AI, there are studies on the prediction of possible sequences of TTPs using game theory [30] and Markov chains [31].…”