Enhancing the STIX Representation of MITRE ATT&amp;CK for Group Filtering and Technique Prioritization

descriptionPublicationkeyboard_double_arrow_right Article , Preprint , Conference object 08 Jun 2022Embargo end date: 01 Apr 2022Publisher:Academic Conferences and Publishing International LtdJournal:European Conference on Cyber Warfare and Security, volume 21, pages 385-391 (issn: 2048-8602, eissn: 2048-8610,

Copyright policy )Funded by:RCN | Automated Cyberthreat Hun...

Authors: Mateusz Zych; Vasileios Mavroeidis;

doi: 10.34190/eccws.21.1.349 , 10.48550/arxiv.2204.11368

arXiv: 2204.11368

Enhancing the STIX Representation of MITRE ATT&CK for Group Filtering and Technique Prioritization

- Summary
- Subjects
- Metrics

Abstract

In this paper, we enhance the machine-readable representation of the ATT&CK Groups knowledge base provided by MITRE in STIX 2.1 format to make available and queryable additional types of contextual information. Such information includes the motivations of activity groups, the countries they have originated from, and the sectors and countries they have targeted. We demonstrate how to utilize the enhanced model to construct intelligible queries to filter activity groups of interest and retrieve relevant tactical intelligence.

Related Organizations

University of Oslo
Norway

Keywords

STIX, FOS: Computer and information sciences, Computer Science - Cryptography and Security, Cyber Threat Intelligence, Threat Actor, TTPs, Knowledge Representation, CTI, MITRE ATT&CK, Cryptography and Security (cs.CR)

Impact byBIP!

	selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).	5
	popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.	Top 10%
	influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).	Average
	impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.	Top 10%