从网络威胁情报报告中挖掘时序攻击模式
Mining Temporal Attack Patterns from Cyberthreat Intelligence Reports
AI总结：
本文提出 ChronoCTI 自动化流水线，利用大语言模型和机器学习从 713 份 CTI 报告中挖掘出 124 个时序攻击模式并分为九类，帮助安全从业者优先防御网络攻击。
摘要：
防御网络攻击需要安全从业者基于高级别的对手行为进行操作。关于过往网络攻击事件的网络威胁情报（CTI）报告描述了随时间推移的恶意行动链。为避免网络攻击事件重演，从业者必须主动识别并防御反复出现的行动链——我们将其称为时序攻击模式。自动挖掘行动间的模式，可提供关于过往网络攻击对手行为的结构化且可操作的信息。本文的目标是通过从网络威胁情报报告中挖掘时序攻击模式，帮助安全从业者进行优先级排序和主动防御。为此，我们提出了 ChronoCTI，一个从过往网络攻击的网络威胁情报（CTI）报告中自动挖掘时序攻击模式的流水线。为构建 ChronoCTI，我们建立了时序攻击模式的真值数据集，并应用了最先进的大型语言模型、自然语言处理和机器学习技术。我们将 ChronoCTI 应用于 713 份 CTI 报告，识别出 124 个时序攻击模式，并将其归类为九个模式类别。我们发现最普遍的模式类别是诱骗受害用户执行恶意代码以发起攻击，其次是在受害网络中绕过反恶意软件系统。基于观察到的模式，我们建议组织对用户进行网络安全最佳实践培训，引入功能受限的不可变操作系统，并强制执行多用户身份验证。此外，我们建议从业者利用 ChronoCTI 的自动挖掘能力，并针对反复出现的攻击模式设计对策。
英文摘要：
Defending from cyberattacks requires practitioners to operate on high-level adversary behavior. Cyberthreat intelligence (CTI) reports on past cyberattack incidents describe the chain of malicious actions with respect to time. To avoid repeating cyberattack incidents, practitioners must proactively identify and defend against recurring chain of actions - which we refer to as temporal attack patterns. Automatically mining the patterns among actions provides structured and actionable information on the adversary behavior of past cyberattacks. The goal of this paper is to aid security practitioners in prioritizing and proactive defense against cyberattacks by mining temporal attack patterns from cyberthreat intelligence reports. To this end, we propose ChronoCTI, an automated pipeline for mining temporal attack patterns from cyberthreat intelligence (CTI) reports of past cyberattacks. To construct ChronoCTI, we build the ground truth dataset of temporal attack patterns and apply state-of-the-art large language models, natural language processing, and machine learning techniques. We apply ChronoCTI on a set of 713 CTI reports, where we identify 124 temporal attack patterns - which we categorize into nine pattern categories. We identify that the most prevalent pattern category is to trick victim users into executing malicious code to initiate the attack, followed by bypassing the anti-malware system in the victim network. Based on the observed patterns, we advocate organizations to train users about cybersecurity best practices, introduce immutable operating systems with limited functionalities, and enforce multi-user authentications. Moreover, we advocate practitioners to leverage the automated mining capability of ChronoCTI and design countermeasures against the recurring attack patterns.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
