Mining Temporal Attack Patterns from Cyberthreat Intelligence Reports
Md Rayhanur Rahman Brandon Wroblewski Quinn Matthews Brantley Morgan Tim Menzies Laurie Williams
Defending from cyberattacks requires practitioners to operate on high-level
adversary behavior. Cyberthreat intelligence (CTI) reports on past cyberattack
incidents describe the chain of malicious actions with respect to time. To
avoid repeating cyberattack incidents, practitioners must proactively identify
and defend against recurring chain of actions - which we refer to as temporal
attack patterns. Automatically mining the patterns among actions provides
structured and actionable information on the adversary behavior of past
cyberattacks. The goal of this paper is to aid security practitioners in
prioritizing and proactive defense against cyberattacks by mining temporal
attack patterns from cyberthreat intelligence reports. To this end, we propose
ChronoCTI, an automated pipeline for mining temporal attack patterns from
cyberthreat intelligence (CTI) reports of past cyberattacks. To construct
ChronoCTI, we build the ground truth dataset of temporal attack patterns and
apply state-of-the-art large language models, natural language processing, and
machine learning techniques. We apply ChronoCTI on a set of 713 CTI reports,
where we identify 124 temporal attack patterns - which we categorize into nine
pattern categories. We identify that the most prevalent pattern category is to
trick victim users into executing malicious code to initiate the attack,
followed by bypassing the anti-malware system in the victim network. Based on
the observed patterns, we advocate organizations to train users about
cybersecurity best practices, introduce immutable operating systems with
limited functionalities, and enforce multi-user authentications. Moreover, we
advocate practitioners to leverage the automated mining capability of ChronoCTI
and design countermeasures against the recurring attack patterns.