Tactics , Techniques And Procedures Research Articles

Targeting in the Russian-Ukrainian War: The Crossroads of Legal and Technical Aspects

Article 82 of Additional Protocol I to the Geneva Conventions requires competent legal advisors to be available, when necessary, to advise military commanders at the appropriate level on the application of International Humanitarian Law (IHL). One of the most important fields of IHL application which requires legal advice is attacks on the enemy, which need to follow the principles of military necessity, humanity, distinction, and proportionality, and are also affected by the requirement to undertake all feasible precautions in order to avoid or at least minimise incidental harm to civilians (collateral damage). One of the ways to ensure that attacks on enemy remain compliant with the requirements of IHL is by adopting appropriate targeting procedures and tools facilitating avoidance or minimising collateral damage, such as the Collateral Damage Estimation Methodology (CDEM). Media coverage of the Russian-Ukrainian war has contributed significantly to the misperception of IHL provisions applicable to targeting. During the war in Ukraine, political declarations were made several times that a war crime had occurred in the form of a deliberate attack on the civilian object. However, the legality of a particular strike can rarely be judged based upon the results of the strike or via post-strike Battle Damage Assessment (BDA). The so-called Rendulic rule emphasises that military necessity, proportionality, and precautions are judged a priori, based upon by the information available at the time of the decision (circumstances ruling at the time) and not on the basis of information emerging after the decision had been made. Legal Advirsors’ role in the targeting process requires them to possess at least the basic knowledge of the Targeting Process and the CDEM, general military expertise in the fields of Tactics, Techniques and Procedures (TTPs), as well as effects of the employment of particular weapon systems in given circumstances. This should be supported by thorough knowledge of IHL, in particular the practical aspects of its application in military operations. It should be about the intersection of legal and technical expertise.

The Lernaean Hydra on the internet: Deplatformization-resistant media ecosystem of the Islamic State

While certain areas of the Islamic State’s activities (propaganda, recruitment, etc.) are well researched, there have been few studies covering the efforts of the organization to neutralize deplatformization, even though its inclusion in a unified system makes it possible to successfully fight against the organization. The present study investigated the Tactics, Techniques and Procedures (TTPs) applied by the Islamic State to maintain its online presence against the deplatforming efforts of law enforcement agencies and social media stakeholders. A closely related topic, namely the key components of the organization’s successful internet activity, is also examined in this article. During the research, authors mapped and plotted one part of the Islamic State’s internet ecosystem to discover the pattern in this interconnected network. Furthermore, the authors elaborated on a volunteer computing based recommendation for paralysing Islamic State-linked websites.

Top of the TTPs: Malware's most common tactics, techniques and procedures

The first step in preventing malware from compromising your organisation is to understand how it works. There are many tactics, techniques and procedures (TTPs) employed by malware developers, but some are more common than others, and honing your security strategy, policies and systems to deal with the most frequent methods will significantly strengthen your defences.

Explainable cyber threat behavior identification based on self-adversarial topic generation

Cyber Threat Intelligence (CTI) provides ample evidence and information regarding the detection of cyber attack activities. Existing methods employ CTI reports to extract Tactics, Techniques and Procedures (TTPs) for attack detection. Nevertheless, these methods are challenged in providing necessary and sufficient evidentiary support for recognition decisions, making it difficult for human operators to comprehend and accept the decision-making process. This paper proposes a topic prototype-based explainable TTPs classification approach, which provides accurate boundaries for key evidences to justify the results of TTPs classification. The proposed method introduces a self-adversarial framework for obtaining necessary and sufficient evidence for TTPs classification. The framework consists of an evidence generator and a TTPs classifier discriminator. The evidence generator utilizes a topic prototype-based keyword importance filtering method to extract evidence from CTI text while removing noise, resulting in an evidence set and a perturbation set. Subsequently, the impact of the evidence set and the perturbation set on TTPs classification is assessed using our siamese discriminator. The discriminator is specifically trained to ensure that only the elements belonging to the evidence set are accurately classified as TTPs information. The experiments primarily test the necessity and sufficiency of TTPs and evidence. In the sufficiency evaluations, classical deep learning methods are used for TTPs classification to verify the accuracy of the results, where the proposed method improves the Micro F1 scores by 0.16% to 6.63% and Macro F1s by 0.26% to 6.85%. To prove necessity, various case-based explainable methods are used to measure the completeness of CTI evidence. The results shows that the proposed method is able to obtain more stable prediction, more reasonable evidence sets, and more significant boundaries.

SeqMask: Behavior Extraction Over Cyber Threat Intelligence Via Multi-Instance Learning

Abstract Identification and extraction of Tactics, Techniques and Procedures (TTPs) for Cyber Threat Intelligence (CTI) restore the full picture of cyber attacks and guide the analysts to assess the system risk. Existing frameworks can hardly provide uniform and complete processing mechanisms for TTPs information extraction without adequate knowledge background. A multi-instance learning approach named SeqMask is proposed in this paper as a solution. SeqMask extracts behavior keywords from CTI evaluated by the semantic impact, and predicts TTPs labels by conditional probabilities. Still, the framework has two mechanisms to determine the validity of keywords. One using expert experience verification. The other verifies the distortion of the classification effect by blocking existing keywords. In the experiments, SeqMask reached 86.07% and 73.99% in F1 scores for TTPs classifications. For the top 20% of keywords, the expert approval rating is 92.20%, where the average repetition of keywords whose scores between 100% and 90% is 60.02%. Particularly, when the top 65% of the keywords were blocked, the F1 decreased to about 50%; when removing the top 50%, the F1 was under 31%. Further, we also validate the possibility of extracting TTPs from full-size CTI and malware whose F1 are improved by 2.16% and 0.81%.

Tactics And Techniques Classification In Cyber Threat Intelligence

Abstract Completing the classification of tactics and techniques in cyber threat intelligence (CTI) is an important way to obtain tactics, techniques and procedures (TTPs) and portray the behavior of cyber attacks. However, the high level of abstraction of tactics and techniques information and their presence in CTI, usually in the form of natural language text, make it difficult for traditional manual analysis methods and feature engineering-based machine learning methods to complete the classification of tactics and techniques effectively. Meanwhile, flat deep learning methods do not perform well in classifying more fine-grained techniques due to their inability to exploit the hierarchical relationship between tactics and techniques. Therefore, this paper regards the tactics and techniques of TTPs defined in Adversarial Tactics, Techniques and Common Knowledge knowledge base as labels and proposes a Convolutional Neural Network (CNN) model based on hierarchical knowledge migration and attention mechanism for classifying tactics and techniques in CTI, named HM-ACNN (CNN based on hierarchical knowledge migration and attention mechanism). HM-ACNN classifies tactics and techniques into two phases, and the underlying network model for both phases is the Attention-based CNN network. The first step in HM-ACNN is converting the CTI text into a two-dimensional image based on the word embedding model, and then start training the classification of tactics through the CNN structure based on the attention mechanism before the classification of techniques. Secondly, after the tactics classification training is completed, the tactic-to-technique knowledge migration is then completed by transforming the parameters of the CNN layer and the attention layer in the tactics classification process based on the special hierarchical relationship between tactics and techniques. Then, the classification of techniques is finished by fine-tuning. The experimental results show that HM-ACNN performs well in the tactics and techniques classification tasks, and the metric F1 values reach 93.66% and 86.29%, which are better than other models such as CNN, Recurrent Neural Network and CRNN (Recurrent Convolutional Neural Networks).

TIM: threat context-enhanced TTP intelligence mining on unstructured threat data

TTPs (Tactics, Techniques, and Procedures), which represent an attacker’s goals and methods, are the long period and essential feature of the attacker. Defenders can use TTP intelligence to perform the penetration test and compensate for defense deficiency. However, most TTP intelligence is described in unstructured threat data, such as APT analysis reports. Manually converting natural language TTPs descriptions to standard TTP names, such as ATT&CK TTP names and IDs, is time-consuming and requires deep expertise. In this paper, we define the TTP classification task as a sentence classification task. We annotate a new sentence-level TTP dataset with 6 categories and 6061 TTP descriptions from 10761 security analysis reports. We construct a threat context-enhanced TTP intelligence mining (TIM) framework to mine TTP intelligence from unstructured threat data. The TIM framework uses TCENet (Threat Context Enhanced Network) to find and classify TTP descriptions, which we define as three continuous sentences, from textual data. Meanwhile, we use the element features of TTP in the descriptions to enhance the TTPs classification accuracy of TCENet. The evaluation result shows that the average classification accuracy of our proposed method on the 6 TTP categories reaches 0.941. The evaluation results also show that adding TTP element features can improve our classification accuracy compared to using only text features. TCENet also achieved the best results compared to the previous document-level TTP classification works and other popular text classification methods, even in the case of few-shot training samples. Finally, the TIM framework organizes TTP descriptions and TTP elements into STIX 2.1 format as final TTP intelligence for sharing the long-period and essential attack behavior characteristics of attackers. In addition, we transform TTP intelligence into sigma detection rules for attack behavior detection. Such TTP intelligence and rules can help defenders deploy long-term effective threat detection and perform more realistic attack simulations to strengthen defense.

The Triangle Model for Cyber Threat Attribution

ABSTRACT Advanced Persistent Threats (APTs) have caused much grief over the years to organizations, both government and private. APTs are highly sophisticated, multi-stage and targeted attacks that have led to an increased demand on tracking threat actor groups and attribution for such cyber-attacks. Cyber threat attribution is the process of associating a targeted cyber-attack against a Threat Actor. Cyber threat attribution is fast becoming an important component in cyber defense operations. Determining cyber threat attribution enables an organization to understand the adversaries modus operandi and the Threat Actor’s objective. This allows organizations to augment their defenses, thereby, preventing future cyber-attacks. This paper introduces a model that can be used by organizations to effectively determine cyber threat attribution. The model uses three high-fidelity indicators for determining attribution and hence the name the Triangle Model. The vertices of the Triangle Model are sector, tools and tactics, techniques and procedures (TTPs). The Triangle Model sees tools and TTPs as high-fidelity indicators since it is hard for a Threat Actor to change tools and even harder to change behavior. The Triangle Model maps the TTPs identified in the victim organization’s intrusion set to the MITRE ATT&CK Framework.

Mathematical Study of Advanced Persistent Threat (APT) Hunting Techniques

The paper documents, based mainly on [3]-[6] published papers where a consistent mathematical description of cyberspace and various types of Cyber-Attacks and protection measures are presented, a holistic mathematical approach to a rigorous description of Advanced Persistent Threat (APT) actors’ modus operandi through various scenarios and Cyber Kill Chain stages [2]. After referring [6] to the various elements of Cyber-Attacks we propose some techniques (via 5 scenarios) of tracking the modus operandi of the most sophisticated and non-linear cyber actors, the Advanced Persistent Threat actors that are usually nation-state or nation-state backed and usually stay undetected for an extended time in later stages of Cyber Kill Chain in defenders’ networks. Keywords: Valuation of cyber assets, vulnerability of cyber assets, node supervision, sophistication of an attack germ of cyber-attack, cyber defense, proactive cyber protection, Advanced Persistent Threat (APT) actors, Indication of Compromise (IOC), Tactics, Techniques and Procedures (TTPs).

Extraction of knowledge from open government data

PurposeThe purpose of this paper is to establish a new conceptual iterative framework for extracting knowledge from open government data (OGD). OGD is becoming a major source for knowledge and innovation to generate economic value, if properly used. However, currently there are no standards or frameworks for applying knowledge continuum tactics, techniques and procedures (TTPs) to improve elicit knowledge extraction from OGD in a consistent manner.Design/methodology/approachThis paper is based on a comprehensive review of literature on both OGD and knowledge management (KM) frameworks. It provides insights into the extraction of knowledge from OGD by using a vast array of phased KM TTPs into the OGD lifecycle phases.FindingsThe paper proposes a knowledge iterative value network (KIVN) as a new conceptual model that applies the principles of KM on OGD. KIVN operates through applying KM TTPs to transfer and transform discrete data into valuable knowledge.Research limitations/implicationsThis model covers the most important knowledge elicitation steps; however, users who are interested in using KIVN phases may need to slightly customize it based on their environment and OGD policy and procedure.Practical implicationsAfter its validation, the model allows facilitating systemic manipulation of OGD for both data-consuming industries and data-producing governments to establish new business models and governance schemes to better make use of OGD.Originality/valueThis paper offers new perspectives on eliciting knowledge from OGD and discussing crucial, but overlooked area of the OGD arena, namely, knowledge extraction through KM principles.

A machine learning framework for investigating data breaches based on semantic analysis of adversary’s attack patterns in threat intelligence repositories

With the ever increasing cases of cyber data breaches, the manual process of sifting through tons of security logs to investigate cyber-attacks is error-prone and time-consuming. Signature-based deep search solutions only give accurate results if the threat artifacts are precisely provided. With the burgeoning variety of sophisticated cyber threats having common attack patterns and utilizing the same attack tools, a timely investigation is nearly impossible. There is a need to automate the threat analysis process by mapping adversary’s Tactics, Techniques and Procedures (TTPs) to attack goals and detection mechanisms. In this paper, a novel machine learning based framework is proposed that identifies cyber threats based on observed attack patterns. The framework semantically relates threats and TTPs extracted from well-known threat sources with associated detection mechanisms to form a semantic network. This network is then used to determine threat occurrences by forming probabilistic relationships between threats and TTPs. The framework is trained using a TTP taxonomy dataset and the performance is evaluated with threat artifacts reported in threat reports. The framework efficiently identifies attacks with 92% accuracy and low false positives even in the case of lost and spurious TTPs. The average detection time of a data breach incident is 0.15 s for a network trained with 133 TTPs from 45 threat families.

Classification of Terrorist Group Events in the Philippines: Location, Location, Location

ABSTRACT In the ongoing effort to assign culpability for terrorists’ violent attacks, the situation in the Philippines is typical. There are large numbers of widely‐scattered attacks following varied tactics, techniques and procedures (TTP). Many, but not all, are claimed or definitively attributed publically by authoritative sources to specific groups; many are not. The Institute for the Study of Violent Groups (ISVG) database is a huge compendium of public sources on attacks around the globe, and is relatively complete since 2003. Using the data in the ISVG database, we submit the roughly two thousand violent attacks (armed assaults, bombings, hijackings, and hostage‐takings) reported between 1/1/2003 and 6/3/2009 to a modern update of one of the earliest, but still reputable, classification technique – Nearest Neighbor. The technique turns out to be remarkably accurate, and serves well to underscore the critical, even definitive, role of location for culpability attribution in the Philippines.