An Association Rule Mining-Based Framework for Profiling Regularities in Tactics Techniques and Procedures of Cyber Threat Actors
| Title | An Association Rule Mining-Based Framework for Profiling Regularities in Tactics Techniques and Procedures of Cyber Threat Actors |
| Publication Type | Conference Paper |
| Year of Publication | 2018 |
| Authors | Noor, U., Anwar, Z., Noor, U., Anwar, Z., Rashid, Z. |
| Conference Name | 2018 International Conference on Smart Computing and Electronic Enterprise (ICSCEE) |
| ISBN Number | 978-1-5386-4838-4 |
| Keywords | association rule mining, behavior, Computer hacking, Conferences, CTAs, cyber domain, Cyber Threat Actor, cyber threat actors, cyber threat intelligence, data mining, feature extraction, Information Gain, input cyber threat intelligence documents, learning (artificial intelligence), machine learning-based framework, Malware, Metrics, privacy, profiling regularities, pubcrawl, security of data, STIX, tactics techniques, Tactics Techniques and Procedures, threat information, threat vectors, Tools, TTPs |
| Abstract | Tactics Techniques and Procedures (TTPs) in cyber domain is an important threat information that describes the behavior and attack patterns of an adversary. Timely identification of associations between TTPs can lead to effective strategy for diagnosing the Cyber Threat Actors (CTAs) and their attack vectors. This study profiles the prevalence and regularities in the TTPs of CTAs. We developed a machine learning-based framework that takes as input Cyber Threat Intelligence (CTI) documents, selects the most prevalent TTPs with high information gain as features and based on them mine interesting regularities between TTPs using Association Rule Mining (ARM). We evaluated the proposed framework with publicly available TTPbased CTI documents. The results show that there are 28 TTPs more prevalent than the other TTPs. Our system identified 155 interesting association rules among the TTPs of CTAs. A summary of these rules is given to effectively investigate threats in the network. |
| URL | https://ieeexplore.ieee.org/document/8538379 |
| DOI | 10.1109/ICSCEE.2018.8538379 |
| Citation Key | noor_association_2018 |
- machine learning-based framework
- TTPs
- tools
- threat vectors
- threat information
- Tactics Techniques and Procedures
- tactics techniques
- STIX
- security of data
- pubcrawl
- profiling regularities
- privacy
- Metrics
- malware
- association rule mining
- learning (artificial intelligence)
- input cyber threat intelligence documents
- Information Gain
- feature extraction
- Data mining
- cyber threat intelligence
- cyber threat actors
- Cyber Threat Actor
- cyber domain
- CTAs
- Conferences
- Computer hacking
- behavior