Cyber Attacker Profiling for Risk Analysis Based on Machine Learning.

Area of Science:

• Cybersecurity
• Risk Analysis
• Computer Science

Background:

• Attacker profiles are crucial for cyber attack forecasting and incident investigations.
• Existing methods for attacker modeling lack a formal structure and comprehensive attribute classification.
• Understanding attacker behavior is key to effective security decision support.

Purpose of the Study:

• To analyze existing research in attacker modeling and propose a structured classification.
• To introduce a formal two-level attacker model for enhanced risk analysis.
• To evaluate the effectiveness of low-level attributes derived from raw security data for profiling.

Main Methods:

• Literature analysis of attacker modeling research.
• Development of a formal two-level attacker model (high-level and low-level attributes).
• Experimental evaluation using attack datasets, focusing on bash commands and event logs.

Main Results:

• A classification of attacker models, attributes, and risk analysis techniques was established.
• Bash history logs were found applicable for differentiating attack team profiles.
• The study identified that nominal parameters like bash commands and event logs can inform high-level attributes.

Conclusions:

• The proposed two-level attacker model provides a structured approach to cyber risk analysis.
• Nominal parameters are valuable for initial attacker profiling, but require augmentation.
• Accurate and detailed attacker profiling necessitates the expansion of low-level attribute sets.