AIセキュリティポータル K Program
APT-MMF: An advanced persistent threat actor attribution method based on multimodal and multilevel feature fusion
Share
Abstract
Threat actor attribution is a crucial defense strategy for combating advanced persistent threats (APTs). Cyber threat intelligence (CTI), which involves analyzing multisource heterogeneous data from APTs, plays an important role in APT actor attribution. The current attribution methods extract features from different CTI perspectives and employ machine learning models to classify CTI reports according to their threat actors. However, these methods usually extract only one kind of feature and ignore heterogeneous information, especially the attributes and relations of indicators of compromise (IOCs), which form the core of CTI. To address these problems, we propose an APT actor attribution method based on multimodal and multilevel feature fusion (APT-MMF). First, we leverage a heterogeneous attributed graph to characterize APT reports and their IOC information. Then, we extract and fuse multimodal features, including attribute type features, natural language text features and topological relationship features, to construct comprehensive node representations. Furthermore, we design multilevel heterogeneous graph attention networks to learn the deep hidden features of APT report nodes; these networks integrate IOC type-level, metapath-based neighbor node-level, and metapath semantic-level attention. Utilizing multisource threat intelligence, we construct a heterogeneous attributed graph dataset for verification purposes. The experimental results show that our method not only outperforms the existing methods but also demonstrates its good interpretability for attribution analysis tasks.
A Hierarchical Model of Targeted Cyber Attacks Attribution
L. Chaoge, F. Binxing, L. Baoxu, C. Xiang, L. Qixu
Published: 2019
The diamond model of intrusion analysis
S. Caltagirone, A. Pendergast, C. Betz
Published: 2013
Levels Analysis of Network Attack Traceback
C. Zhouguo, P. Shi, H. Yao, H. Chen
Published: 2014
Cyber attribution 2.0: Capture the false flag
T. Pahi, F. Skopik
Published: 2019
Cyber attribution: An argumentation-based approach
P. Shakarian, G.I. Simari, G. Moores, S. Parsons
Published: 2015
Toward argumentation-based cyber attribution
E. Nunes, P. Shakarian, G. Simari
Published: 2016
Helping forensic analysts to attribute cyber-attacks: an argumentation-based reasoner
E. Karafili, L. Wang, A.C. Kakas, E. Lupu
Published: 2018
Data-driven analytics for cyber-threat intelligence and information sharing
S. Qamar, Z. Anwar, M.A. Rahman, E. Al-Shaer, B.-T. Chu
Published: 2017
Cskg4apt: A cybersecurity knowledge graph for advanced persistent threat organization attribution
Y. Ren, Y. Xiao, Y. Zhou, Z. Zhang, Z. Tian
Published: 2022
ATLAS: A sequence-based learning approach for attack investigation
A. Alsaheel, Y. Nan, S. Ma, L. Yu, G. Walkup, Z.B. Celik, X. Zhang, D. Xu
Published: 2021
Apt-kgl: An intelligent apt detection system based on threat knowledge and heterogeneous provenance graph learning
T. Chen, C. Dong, M. Lv, Q. Song, H. Liu, T. Zhu, K. Xu, L. Chen, S. Ji, Y. Fan
Published: 2022
DeepAPT: Nation-State APT Attribution Using End-to-End Deep Neural Networks
I. Rosenberg, G. Sicard, E. David
Published: 2017
Method of Cyber Attack Attribution Based on Graph Model
K.Z. Huang, Y.F. Lian, D.G. Feng, H.X. Zhang, D. Wu, X.L. Ma
Published: 2022
A survey on cybersecurity knowledge graph construction
X. Zhao, R. Jiang, Y. Han, A. Li, Z. Peng
Published: 2023
Bert: Pre-training of deep bidirectional transformers for language understanding
Jacob Devlin, Ming-Wei Chang, Kenton Lee, Kristina Toutanova
Published: 2019
node2vec: Scalable feature learning for networks
A. Grover, J. Leskovec
Published: 2016
DeepWalk: Online learning of social representations
B. Perozzi, R. Al-Rfou, S. Skiena
Published: 2014
Semi-supervised classification with graph convolutional networks
Thomas N Kipf, Max Welling
Published: 2017
Hincti: A cyber threat intelligence modeling and identification system based on heterogeneous information network
Y. Gao, L.I. Xiaoyong, P. Hao, B. Fang, P. Yu
Published: 2020
Share