隐藏主题驱动的网络情报模型用于使用混合框架和Birch启发的优化来检测战术,技术和程序 (TTPs).
Musaed Mutared Alanazi1, Ainuddin Wahid Abdul Wahab2,3,4, Mohd Yamani Idna Idris5,6,7
1Faculty of Computer Science and Information Technology, Universiti Malaya, Kuala Lumpur, 50603, Malaysia.
Scientific reports
|December 3, 2025
概括
这项研究引入了一种减少偏差的方法来分析高级持久威胁 (APT) 恶意软件,使得攻击者更快,更准确地识别攻击者策略,技术和程序 (TTP) 以改善网络安全防御.
科学领域:
- 网络安全 网络安全
- 恶意软件分析 恶意软件分析
- 威胁情报 威胁情报
背景情况:
- 提前持续威胁 (APT) 活动的早期检测依赖于了解攻击者的战术,技术和程序 (TTP).
- 现有的方法经常使用供应商策划的情报,这可能会引入商业或地缘政治偏见.
- 需要一种减少偏见的方法来分析恶意软件行为和TTP.
研究的目的:
- 开发和评估一种新的方法来从恶意软件样本中提取TTP,并减少偏差.
- 引入一个减少偏差的恶意软件-TTP库和一个低延迟处理工具 (LTDCT-TTPDBIO).
- 将TTP的流行与特定APT群体的能力联系起来,并为主动防御提供见解.
主要方法:
- 组装了一个由2097个恶意软件样本组成的库,归因于十个APT组.
- 在高保真沙箱中引爆恶意软件样本,以生成非结构化的文本痕迹.
- 利用LTDCT-TTPDBIO,一个带有伯奇灵感优化器和随机森林分类器的隐藏主题模型,将日志转换为MITRE ATT&CK标签.
主要成果:
- 经过LTDCT-TTPDBIO处理的样本具有较低的延迟 (约. 1.45分钟/样本),比基线和最近的方法快得多.
- 实现了高检测质量:95.33%的准确性,97.32%的精度,94.61%的回忆率和95.65%的F1分数 (80-20分).
- 结构化数据集量化了APT组中的恶意软件-TTP分布,识别了经常观察到的技术及其防御影响.
结论:
- 从原始沙箱数据中有效地提取TTP,为积极的APT防御提供了持久且抗偏差的基础.
- 与现有技术相比,开发的方法提供了更高的速度和精度.
- 这些发现使我们能够更深入地了解APT群体的行为,并增强网络安全策略.
相关概念视频
01:19High-Level and Low-Level Awareness
613
Controlled processes in human consciousness represent high-alert mental states where individuals deliberately focus their attention on achieving specific goals. Controlled processes can be seen in situations like mastering new technology, where a person might become so absorbed that they ignore surrounding distractions. Such processes involve selective attention, requiring one to concentrate on particular elements of experience while disregarding others. These are governed by executive...
613
01:20Introduction to Cognitive Psychology
2.2K
Cognitive psychology is the field of psychology dedicated to examining how people think. It attempts to explain how and why we think the way we do by studying the interactions among human thinking, emotion, creativity, language, and problem-solving, as well as other cognitive processes. Cognitive psychology studies how information is processed and manipulated in remembering, thinking, and knowing.
This field emerged in the mid-20th century, following a period dominated by behaviorism, which...
This field emerged in the mid-20th century, following a period dominated by behaviorism, which...
2.2K
01:21Heuristics
621
Heuristics are problem-solving strategies that use mental shortcuts to simplify decision-making. Unlike algorithms, which must be followed precisely to achieve a correct result, heuristics offer a general problem-solving framework. They save time and energy but can sometimes lead to less rational decisions.
People often rely on heuristics when faced with an overload of information, limited time, low importance of the decision, limited information, or when a heuristic readily comes to mind. For...
People often rely on heuristics when faced with an overload of information, limited time, low importance of the decision, limited information, or when a heuristic readily comes to mind. For...
621