Automatic generation of cause and effect attack predictions models via threat intelligence data
A method for predicting a future stage of an attack on a computer system. The method comprises performing, by the computer system, linguistic analysis on threat intelligence reports, where the threat intelligence reports comprise known stages of the attack. The method also comprises processing, by the computer system, the linguistic analysis with a transition matrix to determine probabilities of cause-and-effect relationships between the known stages of the attack, updating, by the computer system, a probability model based on the probabilities determined by the transition matrix, and predicting, by the computer system, the future stage of the attack based on the probability model and attack classifications.
1 . A method for predicting a future stage of an attack on a computer system, comprising:
performing, by the computer system, linguistic analysis on threat intelligence reports, the threat intelligence reports comprising known stages of the attack;
processing, by the computer system, the linguistic analysis with a transition matrix that represents probabilities of transitions between multiple attack stages to determine probabilities of cause-and-effect relationships between the known stages of the attack;
updating, by the computer system, a probability model based on the probabilities determined by the transition matrix using new threat intelligence data processed through the transition matrix; and
predicting, by the computer system, a probabilistic sequence of multiple future stages in the attack based on the probability model and a plurality of attack classifications.
2 . The method of claim 1 , further comprising:
choosing, by the computer system, the probability model from a plurality of probability models.
3 . The method of claim 1 , further comprising:
setting, by the computer system, the plurality of attack classifications based on an evidence data set including logs that are collected from at least one of security tools, network devices, identity management systems, cloud workspace applications, and endpoint operating system.
4 . The method of claim 1 , further comprising:
performing, by the computer system, the linguistic analysis initially using a pre-trained natural language processing (NLP) model configured to predict missing textual terms.
5 . The method of claim 4 , further comprising:
performing, by the computer system, the NLP model using a Bidirectional Encoder Representations from Transformers (BERT) Machine Learning algorithm for creating NLP predictive models based on textual data in an unsupervised manner.
6 . The method of claim 1 , further comprising:
predicting, by the computer system, the future stage in the attack based on a plurality of probability models and combining the predictions from the plurality of probability models as a combined prediction of the future stage in the attack.
7 . The method of claim 6 , wherein the plurality of probability models includes a Quasi-Linear prediction model and a Bayesian Belief Network prediction model.
8 . The method of claim 1 , further comprising:
predicting, by the computer system, the future stage in the attack by specifying at least one of attack tactics, attack techniques, attack sub-techniques and attack software identity.
9 . The method of claim 1 , further comprising:
generating, by the computer system, the probability model by:
performing matrix decomposition of the transition matrix using a plurality of matrix decomposition methods,
scoring the decomposition for each of the plurality of matrix decomposition methods,
selecting one of the matrix decompositions based on the scoring, and
generating the probability model using the selected one of the matrix decompositions.
10 . The method of claim 9 , further comprising:
performing, by the computer system, the matrix decomposition as a main matrix including non-cyclic transitions of the known stages of the attack and supplement matrix including cyclic transitions of the known stages of the attack.
11 . A non-transitory computer readable medium comprising one or more sequences of instructions, which, when executed by a processor, causes a computer system to predict a future stage of an attack on another computer system by performing operations comprising:
performing, by the computer system, linguistic analysis on threat intelligence reports, the threat intelligence reports comprising known stages of the attack;
processing, by the computer system, the linguistic analysis with a transition matrix that represents probabilities of transitions between multiple attack stages to determine probabilities of cause-and-effect relationships between the known stages of the attack;
updating, by the computer system, a probability model based on the probabilities determined by the transition matrix using new threat intelligence data processed through the transition matrix; and
predicting, by the computer system, a probabilistic sequence of multiple future stages in the attack based on the probability model and a plurality of attack classifications.
12 . The non-transitory computer readable medium of claim 11 , further comprising:
choosing, by the computer system, the probability model from a plurality of probability models.
13 . The non-transitory computer readable medium of claim 11 , further comprising:
setting, by the computer system, the plurality of attack classifications based on an evidence data set including logs that are collected from at least one of security tools, network devices, identity management systems, cloud workspace applications, and endpoint operating system.
14 . The non-transitory computer readable medium of claim 11 , further comprising:
performing, by the computer system, the linguistic analysis initially using a pre-trained natural language processing (NLP) model configured to predict missing textual terms.
15 . The non-transitory computer readable medium of claim 14 , further comprising:
performing, by the computer system, the NLP model using a Bidirectional Encoder Representations from Transformers (BERT) Machine Learning algorithm for creating NLP predictive models based on textual data in an unsupervised manner.
16 . The non-transitory computer readable medium of claim 11 , further comprising:
predicting, by the computer system, the future stage in the attack based on a plurality of probability models and combining the predictions from the plurality of probability models as a combined prediction of the future stage in the attack.
17 . The non-transitory computer readable medium of claim 16 , wherein the plurality of probability models includes a Quasi-Linear prediction model and a Bayesian Belief Network prediction model.
18 . The non-transitory computer readable medium of claim 11 , further comprising:
predicting, by the computer system, the future stage in the attack by specifying at least one of attack tactics, attack techniques, attack sub-techniques and attack software identity.
19 . The non-transitory computer readable medium of claim 11 , further comprising:
generating, by the computer system, the probability model by:
performing matrix decomposition of the transition matrix using a plurality of matrix decomposition methods,
scoring the decomposition for each of the plurality of matrix decomposition methods,
selecting one of the matrix decompositions based on the scoring, and
generating the probability model using the selected one of the matrix decompositions.
20 . The non-transitory computer readable medium of claim 19 , further comprising:
performing, by the computer system, the matrix decomposition as a main matrix including non-cyclic transitions of the known stages of the attack and supplement matrix including cyclic transitions of the known stages of the attack.