Browsing by Author "Mckee, Cole"

Filter results by typing the first few letters
Now showing 1 - 2 of 2
  • No Thumbnail Available
    ItemMetadata only
    Activity-Attack Graphs for Intelligence-Informed Threat COA Development
    (IEEE, 2023-03-08) Mckee, Cole; Edie, Kelsie; Duby, Adam
    A threat course of action (COA) describes the likely tactics, techniques, and procedures (TTPs) an adversary may deploy across the cyber kill-chain. Threat COA development and analysis informs hunt teams, incident responders, and threat emulation efforts on likely activities the adversary will conduct during an attack. In this paper, we propose a novel approach to generate and evaluate threat COAs through association rule mining. We identify frequent TTP itemsets to create a set of activity groups that describe associations between TTPs. We overlay activity groups to create a directed and edge-weighted activity-attack graph. The graphs hypothesize various adversary avenues of attack, and the weighted edges inform the analyst's trust of a hypothesized TTP in the COA. Our research identifies meaningful associations between TTPs and provides an analytical approach to generating threat COAs. Further, our implementation uses the STIX framework for extensibility and usability in a variety of threat intelligence environments.
  • No Thumbnail Available
    ItemMetadata only
    Extending Threat Playbooks for Cyber Threat Intelligence: A Novel Approach for APT Attribution
    (IEEE, 2023) Edie, Kelsie; Mckee, Cole; Duby, Adam
    As cyber attacks grow in complexity and frequency, cyber threat intelligence (CTI) remains a priority objective for defenders. A critical component of CTI at the strategic level of defensive operations is attack attribution. Attributing an attack to a threat group informs defenders on adversaries that are actively engaging them and advances their ability respond. In this paper, we propose a data analytic approach towards threat attribution using adversary playbooks of tactics, techniques, and procedures (TTPs). Specifically, our approach uses association rule mining on a large real world CTI dataset to extend known threat TTP playbooks with statistically probable TTPs the adversary may deploy. The benefits are twofold. First, we offer a dataset of learned TTP associations and extended threat playbooks. Second, we show that we can attribute attacks using a weighted Jaccard similarity with 96% accuracy.