Download as PDF, PPTX
![Data Representation
• MISP's granularity level might not be good enough if we're only using MITRE
metadata to differentiate threat actors
• MISP allow us to associate MITRE techniques with an event, but not to specify
which kill chain step the technique was used for in the context of the event
• Overall, recorded threat actors seem to be using the same techniques
• Desired mapping (actor) - [uses] -> (technique:step)
Remaining Issues](https://image.slidesharecdn.com/thinkingraphs-vm-210120132622/85/ATTACKers-Think-in-Graphs-Building-Graphs-for-Threat-Intelligence-18-320.jpg)
Uploaded byMITRE - ATT&CKcon
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
The document discusses the use of graphs for analyzing and visualizing cyber threats and attack data within the MITRE ATT&CK framework. It highlights various representation methods, such as event-centric and actor-centric graphs, to identify patterns and trends among threat actors and techniques. Key questions include the granularity of data, the completeness of received information, and potential additional data sources to enhance threat intelligence analysis.
More Related Content
Similar to ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
- 1. Building Graphs forThreat Intelligence ATT&CKers Think in Graphs Valentine Mairet & Samantha Gottlieb
- 2. McAfee ATR At McAfeeAdvanced Threat Research (McAfee ATR), our goal is to identify and illuminate a broad spectrum of threats in today's complex landscape. Valentine McAfee ATR since May 2020 Red Team and Blue Team WICCA Interests: Writing, cats, D&D Twitter: @vm00z Who
- 4. A tale ofMISP triage Cyber threats and attack data are analyzed and dissected into: ▪ MITRE ATT&CK techniques ▪ Target country information ▪ Threat Actor ▪ Sector ▪ Tools used ▪ etc Threat Intelligence
- 5. Research Goal • Howcan we connect all this information? • Can we quickly visualize connections between events? • Can we identify patterns between threats and attacks? • Can we identify trends in the data? • What are we missing? Questions and challenges
- 6.
- 7. Based on ourdata… Frequency • Which techniques are observed most often? • Which actors are the most active? Popularity • Which techniques are the most common across actors? Patterns • Can we identify groups of actors using the same techniques? • Are actors using techniques in the same way?
- 9. Initial Representation • Dense,highly connected graph • Sparse sector and country data, offers little differentiation Event-centric Representation • Useful for questions of about frequency Actor-centric Representation • Useful for questions about actor behavioral patterns Different Graphs for Different Questions
- 10.
- 11.
- 12. Which techniques areobserved most often? Event-centric graph + Degree analysis
- 13. Which techniques themost common across actors? Actor-centric graph + Centrality algorithms
- 14. Important to tryvarious algorithms Actor-centric graph + Community detection algorithms Can we identify groups of actors using the same techniques?
- 15. Based on ourdata… Frequency • Which techniques are observed most often? • Which actors are the most active? Popularity • Which techniques are the most common across actors? Patterns • Can we identify groups of actors using the same techniques? • Are actors using techniques in the same way?
- 16. Add in KillChain Information
- 17. Are actors usingtechniques in the same way?
- 18. Data Representation • MISP'sgranularity level might not be good enough if we're only using MITRE metadata to differentiate threat actors • MISP allow us to associate MITRE techniques with an event, but not to specify which kill chain step the technique was used for in the context of the event • Overall, recorded threat actors seem to be using the same techniques • Desired mapping (actor) - [uses] -> (technique:step) Remaining Issues
- 19. Conclusion • Helps usvisualize data instantly • Helps us make sense of the data we see • Helps us connect cyber threats and attacks • Can do much more… Building graphs the right* way…
- 20. Conclusion • How canwe add more granularity? • Is the data we receive complete enough? • Are there additional data sources to incorporate? A few questions that remain:
- 21.