Clustering APT Groups Through Cyber Threat Intelligence by Weighted Similarity Measurement

Zheng Shao Chen, R. Vaitheeshwari, Eric Hsiao Kuang Wu, Ying Dar Lin, Ren Hung Hwang, Po Ching Lin, Yuan Cheng Lai, Asad Ali

研究成果: 雜誌貢獻期刊論文同行評審

摘要

Advanced Persistent Threat (APT) groups pose significant cybersecurity threats due to their sophisticated and persistent nature. This study introduces a novel methodology to understand their collaborative patterns and shared objectives, which is crucial for developing robust defense mechanisms. We utilize MITRE ATTACK Techniques, software, target nations, and industries as our primary features to understand the characteristics of APT groups. Since essential information is often buried within the unstructured data of Cyber Threat Intelligence (CTI) reports, we employ Natural Language Processing (NLP) and Named Entity Recognition (NER) to extract relevant data. To analyze and interpret the complex relationships between APT groups, we compute similarity among the features using weighted cosine similarity metrics and Machine Learning (ML) models, enhanced by feature crosses and feature selection strategies. Subsequently, hierarchical clustering is used to group APTs based on their similarity scores, helping to identify common behaviors and uncover deeper relationships. Our methodology demonstrates notable clustering performance, with a silhouette coefficient of 0.76, indicating strong intra-cluster similarity. The Adjusted Rand Index (ARI) of 0.63, though moderate, effectively measures agreement between our clustering and the ground truth. These metrics provide robust validation, surpassing commonly recognized benchmarks for effective clustering in cybersecurity. Our methodology successfully classifies 23 distinct APT groups into six clusters, highlighting the importance of techniques and industry features in the clustering process. Notably, techniques such as T1059 (Command and Scripting Interpreter) and T1036 (Masquerading) are prevalently deployed, observed in 18 out of 23 APT groups across all six clusters.

原文???core.languages.en_GB???
頁(從 - 到)141851-141865
頁數15
期刊IEEE Access
12
DOIs
出版狀態已出版 - 2024

指紋

深入研究「Clustering APT Groups Through Cyber Threat Intelligence by Weighted Similarity Measurement」主題。共同形成了獨特的指紋。

引用此