Cyberattack Scoring Using ATT&CK-Based Weighted Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyberattack scoring methods are subjective and lack objective criteria for comparing scores across different analysts, and they fail to utilize the full potential of frameworks like ATT&CK for comprehensive scoring.
Innovation Solution
A cyberattack scoring apparatus and method that utilizes the ATT&CK framework to objectively determine scores for unit attacks based on attributes such as tactics, target platforms, permissions, and severity levels, excluding subjective attributes and attributes without objective comparison, and applies weighted sums to calculate a comprehensive cyberattack score.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If subjective scoring methods are used by analysts, then flexibility in assessment is maintained, but objectivity and comparability of scores across different analysts deteriorate
Solution Approach 1:
The patent transforms the scoring process from subjective analyst judgment to objective parameter-based calculation. It defines specific measurable parameters including the number of tactics employed, number of target platforms affected, permission levels required, and severity levels of impacts. Each parameter is assigned a weight and the final score is calculated through a standardized formula, eliminating subjectivity while maintaining assessment flexibility through configurable parameters.
2Reliability
If comprehensive attributes from ATT&CK framework are utilized, then scoring completeness is improved, but calculation complexity increases
Solution Approach 1:
The patent segments the comprehensive ATT&CK framework attributes into five distinct scoring dimensions: tactic diversity (number of different tactics), platform scope (number of target platforms), permission requirements (security privileges needed), impact severity (damage potential), and remote control capability (attack control method). Each dimension is calculated separately with its own weighting, making the complex comprehensive assessment manageable and systematic.
Solution Approach 2:
The patent converts qualitative ATT&CK framework attributes into quantitative parameters suitable for calculation. For example, tactic types are counted as discrete numbers, platform types are enumerated, permission levels are ranked numerically, and severity levels are scaled. This parameter transformation enables automated calculation while maintaining the comprehensive nature of the assessment.
3Measurement precision
If weighted sum calculation is applied to multiple attributes, then scoring accuracy is improved, but computational requirements increase
Solution Approach 1:
The patent employs a weighted sum calculation method where five key parameters are multiplied by predetermined weights and summed to produce the final score. This mathematical approach provides accurate and consistent scoring results while maintaining computational efficiency. The formula structure allows for straightforward implementation using basic arithmetic operations, avoiding complex computational requirements despite the multi-attribute nature of the assessment.
Data Source
AI summary
Proposed is a cyberattack scoring method performed by a cyberattack scoring device including a memory storing one or more instructions and a processor executing the one or more instructions stored in the memory. The method may include determining a tactic for each of unit attacks included in a cyberattack based on an Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework. The method may also include determining a score for each of the unit attacks by calculating a weighted sum on attributes depending on the determined tactic according to priorities. The method may further include determining the score of the cyberattack by summing the determined scores of the unit attacks.