A Modular Approach to Automatic Cyber Threat Attribution using Opinion Pools

TL;DR

The paper addresses automated cyber threat attribution by proposing a modular architecture that uses opinion pools to fuse outputs from diverse attributors. It introduces the Pairing Aggregator, which applies the logarithmic pool to pairs of PMFs and then the linear pool to yield a final PMF over threat actors. Experimental validation on a synthetic dataset shows the modular approach maintains or improves precision and top-$k$ accuracy relative to monolithic baselines and provides interpretable intermediate results. The work argues that modularity improves tractability, usability, and interpretability while remaining interoperable with existing CTI frameworks.

Abstract

Cyber threat attribution can play an important role in increasing resilience against digital threats. Recent research focuses on automating the threat attribution process and on integrating it with other efforts, such as threat hunting. To support increasing automation of the cyber threat attribution process, this paper proposes a modular architecture as an alternative to current monolithic automated approaches. The modular architecture can utilize opinion pools to combine the output of concrete attributors. The proposed solution increases the tractability of the threat attribution problem and offers increased usability and interpretability, as opposed to monolithic alternatives. In addition, a Pairing Aggregator is proposed as an aggregation method that forms pairs of attributors based on distinct features to produce intermediary results before finally producing a single Probability Mass Function (PMF) as output. The Pairing Aggregator sequentially applies both the logarithmic opinion pool and the linear opinion pool. An experimental validation suggests that the modular approach does not result in decreased performance and can even enhance precision and recall compared to monolithic alternatives. The results also suggest that the Pairing Aggregator can improve precision over the linear and logarithmic opinion pools. Furthermore, the improved k-accuracy in the experiment suggests that forensic experts can leverage the resulting PMF during their manual attribution processes to enhance their efficiency.

Figures (8)

• Figure 1: Class diagram describing the proposed modular architecture for threat attribution.
• Figure 2: Workflow how the proposed threat attribution approach is related to other areas of research such as intrusion detection systems.
• Figure 3: Combined histogram and kernel density estimation, depicting the distribution of the number of incidents associated with a threat actor.
• Figure 4: Kernel Density Estimations (KDE) for the number of incidents associated with the first four threat actors over time.
• Figure 5: Cumulative distribution plots depicting the proportion of samples where the correct actor is among the top $k$ most probable outcomes for the various alternatives.