TWC: TTP Option: Small: Automating Attack Strategy Recognition to Enhance Cyber Threat Prediction

网络攻击日益复杂和快速发展。一次攻击可能使用多种侦察、利用和混淆技术。本项目研究如何提取关键攻击属性，合成新的攻击序列，及时揭示关键资产的潜在威胁。该项目使用机器学习技术同时识别新的攻击类型，并观察可以识别这些攻击的事件。项目中的转换到实践组件包括一个三个阶段的计划，以提供一个积极加强和可测量的周期，以开发、评估和改进现实环境中的原型系统。这极大地扩大了安全实践者和学生团队的参与，他们将计划和执行攻击以测试原型系统。这项研究的结果将提供对关键攻击策略的及时理解和预测，为从业者提供解决方案，以平衡对抗复杂攻击者的竞争环境。具体来说，这项工作开发了一个在线半监督学习框架，以捕获攻击策略的空间和时间特征。攻击行为模型是特征概率分布的集合。利用攻击特征，通过蒙特卡罗仿真合成攻击序列。然后使用攻击序列和集成预测来揭示对网络中关键资产的潜在威胁。该项目将在真实世界的攻击数据以及综合网络攻击上进行评估。广泛的扩展计划包括课程模块开发，项目中期研讨会，吸引安全研究人员和从业人员，以及国际会议的总结小组。

Network attacks are increasingly complex and fast-evolving. A single attack may use multiple reconnaissance, exploit, and obfuscation techniques. This project investigates how to extract critical attack attributes, synthesize novel attack sequences, and reveal potential threats to critical assets in a timely manner. The project uses machine learning techniques to simultaneously identify new attack types and observed events that could identify those attacks. The Transition-to-Practice component in the project includes a three-phase plan to provide a positively reinforced and measurable cycle to develop, evaluate, and refine a prototype system in real-world environments. This significantly broadens the engagement of security practitioners and student teams, who will be planning and executing attacks to test the prototype system. The outcome of this research will provide timely comprehension and anticipation of critical attack strategies, offering the practitioners a solution to level the playing field against sophisticated attackers.Specifically, this work develops an online semi-supervised learning framework to capture both spatial and temporal features of attack strategies. An attack behavior model is a collection of feature probability distributions. The attack features are used to synthesize attack sequences via Monte-Carlo simulation. The attack sequences along with an ensemble prediction are then used to reveal potential threats to critical assets in the network. The project will be evaluated on real-world attack data as well as synthetic network attacks. An extensive outreach plan includes course module development, a mid-project workshop to engage security researchers and practitioners, and a summary panel in an international conference.