Camp2Vec: Embedding cyber campaign with ATT&CK framework for attack group analysis

Abstract

As the cyberattack subject has expanded from individual to group, attack patterns have become a complicated form of cyber campaigns. Although detecting the attack groups that operated the cyber campaigns is an important issue, complex methods such as deep learning are difficult to use due to the lack of campaign data. This paper proposes Camp2Vec, a lightweight statistics-based embedding for cyber campaigns, enabling attack group detection. The proposed method models a relationship between a campaign and techniques in the ATT&CK® framework as a document and words. Experimental results with expert-labeled datasets prove that Camp2Vec identifies representative attack groups successfully.

Keywords

• Cyber campaign
• Cyber threat intelligence
• MITRE ATT&CK
• TF-IDF
• TTP sequence