Latent topic-driven cyber intelligence model for tactics, techniques, and procedures (TTPs) detection using hybrid...

Area of Science:

• Cybersecurity
• Malware Analysis
• Threat Intelligence

Background:

• Early detection of Advanced Persistent Threat (APT) campaigns relies on understanding attacker Tactics, Techniques, and Procedures (TTPs).
• Existing methods often use vendor-curated intelligence, which may introduce commercial or geopolitical bias.
• A need exists for a bias-reduced approach to analyze malware behavior and TTPs.

Purpose of the Study:

• To develop and evaluate a novel method for extracting TTPs from malware samples with reduced bias.
• To introduce a bias-reduced malware-TTP corpus and a low-latency processing tool (LTDCT-TTPDBIO).
• To link TTP prevalence to specific APT groups' capabilities and provide insights for proactive defense.

Main Methods:

• Assembled a corpus of 2,097 malware samples attributed to ten APT groups.
• Detonated malware samples in a high-fidelity sandbox to generate unstructured text traces.
• Utilized LTDCT-TTPDBIO, a latent-topic model with a Birch-inspired optimizer and random-forest classifier, to convert logs into MITRE ATT&CK labels.

Main Results:

• LTDCT-TTPDBIO processed samples with low latency (approx. 1.45 min/sample), significantly faster than baseline and recent approaches.
• Achieved high detection quality: 95.33% accuracy, 97.32% precision, 94.61% recall, and 95.65% F1-score (80-20 split).
• The structured dataset quantified malware-TTP distribution across APT groups, identifying frequently observed techniques and their defensive implications.

Conclusions:

• Efficient extraction of TTPs from raw sandbox data provides a durable and bias-resistant foundation for proactive APT defense.
• The developed method offers superior speed and accuracy compared to existing techniques.
• Findings enable a deeper understanding of APT group behaviors and enhance cybersecurity strategies.