TTP automatic extraction and attack team clustering method

Abstract

The invention relates to a TTP automatic extraction and attack team clustering method. Along with increasingly popularization of advanced persistent threats in the global range, the Internet of Thingsis directly exposed to the Internet due to poor security, so that the Internet of Things becomes an excellent weapon for a hacker organization to initiate APT attacks. Therefore, an attacker can establish a botnet by using the attacked Internet of Things device and initiate an APT attack by using the botnet. The invention provides a framework for observing and predicting attacks of the Internet of Things. The framework aims at automatically extracting technologies, tactics and processes of attackers and mining potential attacker teams behind a large number of attacks. Firstly, related fieldsare extracted from captured Internet of Things honeypot logs; and then, the attack behavior is mapped to an ATT & CK framework to realize TTP automatic extraction. Furthermore, the method generates four feature groups including 18 features including TTP, time, IP and URL, potential attack groups are mined through specific hierarchical clustering, and finally, an attack tree is generated for each attacker cluster so as to better describe team attack behaviors.

Description

technical field [0001] The present invention relates to the field of network security, in particular to a method for automatic TTP extraction and attack team clustering, which is used to describe the behavior characteristics of attackers and dig out potential attack teams behind the attack. Background technique [0002] Kaspersky’s Global Research and Analysis Team (GReAT) notes that advanced persistent threat (APT) campaigns have become increasingly sophisticated and damaging since hacking groups launched targeted attacks on critical infrastructure and attempted to compromise central networks sex. At the same time, IoT devices have become the number one security threat to personal privacy, corporate information security, and even critical infrastructure because IoT devices are inherently risky, easily exploited, and exposed to the Internet in large quantities. Worse, attackers can leverage open source tools to quickly assemble malware scans, infiltrate and take control of ...

AI Technical Summary

Problems solved by technology

The present invention uses four feature groups (TTP, time, IP, and URL) extracted from log data to characterize different behaviors of attackers from different dimensions, thereby solving the challenge of describing personal attack behaviors when observing and predicting IoT attacks

Images