Visible to the public Clustering Using a Similarity Measure Approach Based on Semantic Analysis of Adversary Behaviors

TitleClustering Using a Similarity Measure Approach Based on Semantic Analysis of Adversary Behaviors
Publication TypeConference Paper
Year of Publication2020
AuthorsWang, W., Tang, B., Zhu, C., Liu, B., Li, A., Ding, Z.
Conference Name2020 IEEE Fifth International Conference on Data Science in Cyberspace (DSC)
Date PublishedJuly 2020
PublisherIEEE
ISBN Number978-1-7281-9558-2
Keywordsadversary behaviors, Adversary Models, Analytical models, APT groups, Biological system modeling, Community discovery, community groups, complex networks, Human Behavior, Knowledge engineering, Meta path, Metrics, pattern clustering, pubcrawl, resilience, Resiliency, Scalability, security, security analysts, security of data, semantic analysis, semantic links, Semantics, shared information, similarity degree, similarity measure, similarity measure approach, Software, Standards, statistical characteristics, threat intelligence, three-layer model, tracking attacks
Abstract

Rapidly growing shared information for threat intelligence not only helps security analysts reduce time on tracking attacks, but also bring possibilities to research on adversaries' thinking and decisions, which is important for the further analysis of attackers' habits and preferences. In this paper, we analyze current models and frameworks used in threat intelligence that suited to different modeling goals, and propose a three-layer model (Goal, Behavior, Capability) to study the statistical characteristics of APT groups. Based on the proposed model, we construct a knowledge network composed of adversary behaviors, and introduce a similarity measure approach to capture similarity degree by considering different semantic links between groups. After calculating similarity degrees, we take advantage of Girvan-Newman algorithm to discover community groups, clustering result shows that community structures and boundaries do exist by analyzing the behavior of APT groups.

URLhttps://ieeexplore.ieee.org/document/9194468
DOI10.1109/DSC50466.2020.9194468
Citation Keywang_clustering_2020