System and method for attribution of actors to indicators of threats to a computer system and prediction of future threat actions
An information handling system performs a method for analyzing attacks against a networked system of information handling systems. The method includes detecting a threat indicator, representing the threat indicator in part by numerical parameters, normalizing the numerical parameters, calculating one or more measures of association between the threat indicator and other threat indicators, finding an association of the threat indicator with another threat indicator based upon the normalized numerical parameters, and assigning to the threat indicator a probability that a threat actor group caused the attack, wherein the threat actor group was assigned to the other threat indicator. In some embodiments, the normalizing may include transforming a distribution of the numerical parameters to a distribution with a standard deviation of 1 and a mean of 0. In some embodiments, the normalizing may include applying an empirical cumulative distribution function. In some embodiments, the one or more measures of association between the threat indicator and other threat indicators may include a Kendall's tau between the threat indicator and the other threat indicators, a covariance between the threat indicator and the other threat indicators; or a conditional entropy between the threat indicator and the other threat indicators.
1. A computer implemented method, the computer having a processor and memory, the method comprising:
detecting by the computer a threat indicator that provides an indication of an attack against a networked system of information handling systems;
representing the threat indicator in part by numerical parameters;
normalizing the numerical parameters;
calculating one or more measures of association between the threat indicator and other threat indicators based upon the normalized numerical parameters;
finding an association of the threat indicator with another threat indicator based upon the one or more measures of association, wherein the other threat indicator provides an indication of another attack, the other attack attributed to a threat actor group;
attributing the attack to the threat actor group based upon the association;
assigning to the threat indicator a probability that the threat actor group caused the attack;
assessing a risk to the networked system based upon the threat actor group and the probability; and
determining a defense posture for the networked system based upon the risk.
2. The computer implemented method of claim 1 , wherein the normalizing comprises applying an empirical cumulative distribution function.
3. The computer implemented method of claim 1 , wherein the finding the association comprises calculating a Kendall's tau between the threat indicator and the other threat indicator.
4. The computer implemented method of claim 1 , wherein the finding the association comprises calculating a covariance between the threat indicator and the other threat indicator.
5. The computer implemented method of claim 1 , wherein the finding the association comprises calculating a conditional entropy between the threat indicator and the other threat indicator.
6. The computer implemented method of claim 1 , wherein the finding the association comprises determining that at least one of a conditional entropy between the threat indicator and the other threat indicator, a Kendall's tau between the threat indicator and the other threat indicator, and a covariance between the threat indicator and the other threat indicator is a maximal value of the set of conditional entropies between the threat indicator and other threat indicators, the set of Kendall's tau between the threat indicator and the other threat indicators, and the set of covariance between the threat indicator and the other threat indicators.
7. The computer implemented method of claim 1 , wherein the finding the association comprises determining that a combination of a conditional entropy between the threat indicator and the other threat indicator, a Kendall's tau between the threat indicator and the other threat indicator, and a covariance between the threat indicator and the other threat indicator produces a maximal value of the combination between the threat indicator and other threat indicators.
8. The computer implemented method of claim 1 , wherein the assigning the probability comprises performing a regression analysis on the normalized numerical parameters and the one or more measures of association.
9. The computer implemented method of claim 8 , wherein the performing the regression analysis comprises performing a probit regression analysis.
10. The computer implemented method of claim 8 , wherein the performing the regression analysis comprises performing a logistic regression analysis.
11. The computer implemented method of claim 1 , wherein the assessing the risk to the networked system comprises:
generating a set of potential actions Â;
receiving an input logistic prediction model {circumflex over (β)}, wherein {circumflex over (β)} describes a relationship between predictors and a probability that one of the set of potential actions  will be taken; and
applying the model {circumflex over (β)} to values of the predictors, thereby producing propensity scores.
12. The computer implemented method of claim 1 , wherein the assigning the probability comprises calculating a probability that the threat actor group caused the attack according to the formula:
LI
K
(
Y
+
,
Y
r
,
Y
τ
,
Y
h
)
=
e
β
^
(
Y
+
;
Y
r
,
Y
τ
,
Y
h
)
1
+
e
β
^
(
Y
+
;
Y
r
,
Y
τ
,
Y
h
)
wherein: {circumflex over (β)} is an estimator of a statistical relationship between measurements for a threat actor group and similar events in an data repository, Y + is an event, Y r is a list of covariance values between Y+ and other events in an event store, Y τ is a list of Kendall's tau values between Y+ and the other events in the event store, and Y h is a list of conditional entropy values between Y+ and the other events in the event store.
13. The computer implemented method of claim 1 , wherein the assigning the probability comprises applying a model {circumflex over (β)} to input values, the input values including the one or more measures of association.
14. A networked system of information handling systems, comprising:
an intrusion protection and detection system to:
detect a threat indicator that provides an indication of an attack against the networked system;
represent the threat indicator in part by numerical parameters;
normalize the numerical parameters;
calculate one or more quantitative measures of association between the threat indicator and other threat indicators based upon the normalized numerical parameters;
find an association of the threat indicator with another threat indicator based upon the one or more measures of association, wherein the other threat indicator provides an indication of another attack, the other attack attributed to a threat actor group;
attribute the attack to the threat actor group;
assign to the threat indicator a probability that the threat actor group caused the attack;
assess a risk to the networked system based upon the threat actor group and the probability; and
determine a defense posture for the networked system based upon the risk.
15. The networked system of information handling systems of claim 14 , further comprising:
one or more internal networks to connect a plurality of the information handling systems; and
one or more firewalls to protect the plurality of the information handling systems, wherein the one or more firewalls are positioned between the plurality of information handling systems and external networks.
16. The networked system of information handling systems of claim 15 , wherein the one or more quantitative measures of association between the threat indicator and other threat indicators include one or more of the following:
a Kendall's tau between the threat indicator and the other threat indicators;
a covariance between the threat indicator and the other threat indicators; and
a conditional entropy between the threat indicator and the other threat indicators.
17. The networked system of information handling systems of claim 15 , wherein the finding the association comprises determining that either:
at least one of a conditional entropy between the threat indicator and the other threat indicator, a Kendall's tau between the threat indicator and the other threat indicator, and a covariance between the threat indicator and the other threat indicator is a maximal value of the set of conditional entropies between the threat indicator and other threat indicators, the set of Kendall's tau between the threat indicator and the other threat indicators, and the set of covariance between the threat indicator and the other threat indicators; or
a combination of a conditional entropy between the threat indicator and the other threat indicator, a Kendall's tau between the threat indicator and the other threat indicator, and a covariance between the threat indicator and the other threat indicator produces a maximal value of the combination between the threat indicator and other threat indicators.
18. A non-transitory computer-readable medium including code for performing a method of analyzing attacks on a networked system of information handling systems, the method comprising:
detecting a threat indicator that provides an indication of an attack against a networked system of information handling systems;
representing the threat indicator in part by numerical parameters;
normalizing the numerical parameters;
calculating one or more measures of association between the threat indicator and other threat indicators;
finding an association of the threat indicator with another threat indicator based upon the one or more measures of association, wherein the other threat indicator provides an indication of another attack, the other attack attributed to a threat actor group;
attributing the attack to the threat actor group;
assigning to the threat indicator a probability that the threat actor group caused the attack, including performing a regression analysis on the normalized numerical parameters and the one or more measures of association;
assessing a risk to the networked system based upon the threat actor group and the probability; and
determining a defense posture for the networked system based upon the risk.
19. The computer-readable medium of claim 18 , wherein the one or more measures of association between the threat indicator and other threat indicators includes one or more of the following:
a Kendall's tau between the threat indicator and the other threat indicators;
a covariance between the threat indicator and the other threat indicators; and
a conditional entropy between the threat indicator and the other threat indicators.
20. The computer-readable medium of claim 18 , the method further comprising wherein the finding the association comprises determining that either:
at least one of the conditional entropy, the Kendall's tau, and the covariance is a maximal value of the set of conditional entropies between the threat indicator and other threat indicators, the set of Kendall's tau between the threat indicator and the other threat indicators, and the set of covariance between the threat indicator and the other threat indicators; or
a combination of the conditional entropy, the Kendall's tau, and the covariance produces a maximal value of the combination between the threat indicator and other threat indicators.