Quantification of Adversary Tactics, Techniques, and Procedures Using Threat Attribute Groupings and Correlation

A system comprising:

• one or more computing system processors;
• and
• memory storing instructions that, when executed by the one or more computing system processors, causes the system to:
• receive attack data comprising a plurality of attack execution operations,
• determine threat attribute data based on the attack data, the threat attribute data comprising:
• a first threat attribute associated with the plurality of attack execution operations, the first threat attribute comprising threat-actor data indicative of an attacker associated with at least one attack execution operation comprised in the plurality of attack execution operations,
• a second threat attribute associated with the plurality of attack execution operations, the second threat attribute indicative of malware data associated with the at least one attack execution operation comprised in the plurality of attack execution operations,
• a third threat attribute associated with the plurality of attack execution operations, the third threat attribute indicative of security tool data associated with the at least one attack execution operation comprised in the plurality of attack execution operations,
• a fourth threat attribute associated with the plurality of attack execution operations, the fourth threat attribute comprising user data associated with the at least one attack execution operation comprised in the plurality of attack execution operations,
• a fifth threat attribute associated with the plurality of attack execution operations, the fifth threat attribute comprising location data associated with an attack execution operation comprised in the plurality of attack execution operations,
• a sixth threat attribute associated with the plurality of attack execution operations, the sixth threat attribute comprising operating system data associated with executing at least one attack execution operation comprised in the plurality of attack execution operations;
• and
• generate a decision tree using the threat attribute data, the decision tree including at least one first node and a plurality of second nodes connected to the at least one first node, wherein:
• first nodal data is generated and assigned to each second node based on at least one of the first threat attribute, the second threat attribute, the third threat attribute, the fourth threat attribute, the fifth threat attribute, or the sixth threat attribute;
• in response to receiving a security event file, executing one or more security tests, using the decision tree, for the security event file.

A method comprising:

• receiving, using one or more computing device processors, attack data comprising a plurality of attack execution operations,
• determining, using the one or more computing device processors, threat attribute data based on the attack data, the threat attribute data comprising one or more of:
• a first threat attribute associated with the plurality of attack execution operations, the first threat attribute comprising threat-actor data indicative of an attacker associated with at least one attack execution operation comprised in the plurality of attack execution operations,
• a second threat attribute associated with the plurality of attack execution operations, the second threat attribute indicative of malware data associated with the at least one attack execution operation comprised in the plurality of attack execution operations,
• a third threat attribute associated with the plurality of attack execution operations, the third threat attribute indicative of security tool data associated with the at least one attack execution operation comprised in the plurality of attack execution operations,
• a fourth threat attribute associated with the plurality of attack execution operations, the fourth threat attribute comprising user data associated with the at least one attack execution operation comprised in the plurality of attack execution operations,
• a fifth threat attribute associated with the plurality of attack execution operations, the fifth threat attribute comprising location data associated with an attack execution operation comprised in the plurality of attack execution operations, or
• a sixth threat attribute associated with the plurality of attack execution operations, the sixth threat attribute comprising operating system data associated with executing at least one attack execution operation comprised in the plurality of attack execution operations;
• generating, using the one or more computing device processors, a decision tree using the threat attribute data, the decision tree including at least one first node and a plurality of second nodes connected to the at least one first node, wherein:
• first nodal data is generated and assigned to each second node based on at least one of the first threat attribute, the second threat attribute, the third threat attribute, the fourth threat attribute, the fifth threat attribute, or the sixth threat attribute;
• in response to receiving a security event file, executing one or more security tests, using the decision tree, for the security event file.