Focusing on the Weakest Link: A Similarity Analysis on Phishing Campaigns Based on the ATT&CK Matrix

Abstract

In the past, phishing techniques were a common means of attack carried out by individuals or small groups via spam mail on a randomly selected target. However, in recent years, phishing techniques have been adopted by advanced persistent threat (APT) groups to attack organizations such as the Sony Pictures Enterprise and Korea Hydro & Nuclear Power. As such, our study aims to analyze the past campaigns conducted by the APT groups. We aim to propose a countermeasure that corresponds to the phishing campaign by collecting datasets pertaining to the phishing techniques. Based on our past study, we collected private and public data from 16 different cases that utilize a phishing attack. Our research adopted MITRE’s ATT&CK framework and tactic, techniques, and procedures (TTPs) to extract and examine the various campaigns. The framework proposed in this study makes considerable contributions to both the private and public sectors, as the framework aids the organizations in counteracting the malicious threats performed by the APT groups.

Boosting D3FEND: Ontological Analysis and Recommendations

“…In other words, several classes that, even intuitively, are expected to be disjoint are not disjoint, including DIGITAL ARTIFACT and PHYSI-CAL ARTIFACT (for example, HARDWARE DEVICE), PHYSICAL OBJECT and DIGITAL OBJECT, DIGITAL ARTIFACT and DIGITAL EVENT, PHYSICAL LOCATION and PHYS-ICAL OBJECT, among others. Actually, similar issues have been found in other large ontologies, such as Schema.org 11 , where, for example, LOCALBUSINESS is both a PLACE and an ORGANIZATION 12 . In this case specifically, under UFO assumptions, ORGANI-ZATION and PLACE can be seen as different OBJECTS with different unique principles of identity, so they cannot be a subtype of one another [32,2].…”

“…D3FEND's primary goal is to help to standardize the vocabulary used to describe defensive cybersecurity technology functionality. A number of recent cybersecurity studies make use of it for the process of identification and assessment of cyber threats, and response against them [10,11,12,13,14], among other applications, including the design of a game to support security education and risk assessment [15]. D3FEND is also an example of an ontology developed without an explicit tie to an upper ontology, and to the best of our knowledge, there is no systemic ontological analysis of this artifact, whose validity seems to be taken for granted.…”

“…While this paper was being reviewed, another version of D3FEND was released in January 2023, named '0.12.0-BETA-2', which fixed some of the issues that we identified in our analysis, including the logical inconsistency found by the reasoners. Nonetheless, our main argument about the importance of ontological foundations in the ontology engineering practice still holds.11 See: https://schema.org/ 12. LOCALBUSINESS in Schema.org: https://schema.org/LocalBusiness.…”

Propuesta De Un Enfoque Basado en El Aprendizaje Automático Para La Detección De Intrusiones en Redes De Tecnología De Operación

“…Para cada una de las técnicas, MITRE proporciona información sobre posibles mecanismos para su detección y/o mitigación. Estudios recientes como (Xiong et al, 2022), (Liu, Wang y Chen, 2022) y (Shin et al, 2022) también basan sus soluciones en estas matrices.…”

Exploiting TTP Co-Occurrence via GloVe-Based Embedding With MITRE ATT&CK Framework

“…Since TTP information is a simple string, the embedding process is required to use it for training. Previous studies have used very simple embeddings such as onehot vectorization [3], [10]. Although they tried to reflect tactical information in the vectorization process, this approach has the limitation that it does not reflect any statistical information of TTP data.…”