MITRE open CTI contribution to cyber situational awareness

Abstract

A cyber-attack is executed through a series of steps to compromise the security of a target’s cyber assets. Due to the ever-increasing reliance on computer and network systems to implement critical government and commercial operations, cyber-attacks have become significant threats with potentially severe consequences. Within existing research there is a constant and still outstanding issue around the lack of openly available data to use while testing attack detection algorithms. This is particularly true regarding sources of data describing real attacks in terms of the sequencing (the series of steps) of the Tactics and Techniques employed. These sequences can provide analysts with additional specific information about the behaviour of attackers over and above just a list of the techniques that they use. MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base that includes descriptions for over 100 significant APTs and the Tactics, Techniques, Tools, and Procedures (TTPs) that they use. This does not, however, include any knowledge about the sequencing of specific attacks. This thesis provides a proposal to address this lack of available attack sequence intelligence and so increase the contribution that it can make to cyber situational awareness. It presents a model that can be used to record data representing a sequence of MITRE ATT&CK TTPs (an ordered set of Tactic and Techniques) observed during attacks. The model also allows the analyst to record relative timings of the steps taken and to associate each step with a kill chain model view of a cyber-attack. The population of this model is exercised using a representative set of open-source attack reports and several example applications are presented.

More information

Identifiers

ORCID for vladi Sassone: orcid.org/0000-0002-6432-1482

ORCID for Leonardo Aniello: orcid.org/0000-0003-2886-8445

Catalogue record

Export record