How hard can it be? Quantifying MITRE attack campaigns with attack trees and cATM logic

Technical Summary: Quantifying MITRE Attack Campaigns with Attack Trees and cATM Logic

Problem Statement
Cybersecurity practitioners face an overwhelming number of organized Advanced Persistent Threat (APT) campaigns recorded in the MITRE ATT&CK knowledge base. While MITRE ATT&CK is the de facto standard for registering attack tactics and techniques, it lacks a straightforward mechanism for the quantitative comparison of these campaigns, particularly regarding their likelihood of occurrence. Current methods fail to provide:

1. A granular, flexible way to extract likelihood data from MITRE to evaluate the probability of specific campaigns.
2. A formal, "catch-all" method to model and query any recorded campaign to facilitate structured analysis and quantitative comparison.

Without these capabilities, practitioners struggle to prioritize defense resources effectively against the most threatening campaigns.

Methodology
The authors propose a framework grounded in data-mined from MITRE public resources to quantify attack likelihoods and compare campaigns using Attack Trees (ATs) and a revised formal logic called cATM.

1. Data-Driven Likelihood Estimation:

   • The framework treats the frequency of a technique's use within a specific tactic across all recorded campaigns as a proxy for its probability of occurrence.
   • Probabilities are calculated as $p_{E|A} = \frac{\text{count of campaigns using technique } E \text{ for tactic } A}{\text{total count of techniques used for tactic } A}$.
   • The methodology handles data granularity issues (e.g., mixed data where both high-level techniques and sub-techniques are recorded) by prioritizing fine-grained sub-techniques or applying unbiased worst-case assumptions for coarse-grained data.

2. Security Index Metric:

   • To avoid interpreting raw probabilities as absolute real-world likelihoods (which are unknowable due to incomplete data), the authors introduce a Security Index.
   • This is defined as the negative logarithm of the maximum probability of a successful attack: $q_\beta(T) = -\log(q_{\alpha}^{mp}(T))$.
   • This transformation maps the metric to a linearly ordered unital semiring (LOAD) where higher values indicate a more secure (less likely to succeed) campaign, facilitating comparison.

3. Automatic Modeling via Templates:

   • Instead of relying solely on labor-intensive manual modeling, the authors introduce MITRE Attack Tree Templates. These are pre-defined structures that can automatically instantiate any campaign recorded in MITRE.
   • Three difficulty levels are supported to reflect different interpretations of attacker effort:
     • Hard: Requires all recorded techniques for a tactic to succeed (modeled with AND gates).
     • Easy: Requires only one recorded technique per tactic to succeed (modeled with OR gates).
     • Default: A hybrid approach requiring all high-level techniques, but allowing sub-techniques to be OR-gated.
   • These templates capture the full hierarchy of MITRE data (Campaign $\to$ Tactics $\to$ Techniques $\to$ Sub-techniques).

4. cATM Logic:

   • The authors adapt the existing ATM logic into cATM, a simplified, two-layer logic designed for cybersecurity practitioners.
   • cATM allows for querying metrics (like the security index) directly on the templates without manual pruning. It supports interval arithmetic to model uncertainty in probability values.
   • The logic enables the computation of the security index by assigning neutral elements (0 for AND, $\infty$ for OR) to techniques not used in a specific campaign, effectively "pruning" the tree algorithmically.

Key Contributions

1. Quantification Framework: A systematic procedure to compute probability-like values for attack techniques based on MITRE frequency data, operationalized into a security index for campaign comparison.
2. Manual vs. Automatic Modeling: The paper presents two manually constructed "ad hoc" Attack Trees for the Wocao and Dream Job campaigns to serve as ground truth. It then demonstrates that automatically generated templates (specifically the "default" difficulty level) produce security indices very close to these manual models but with significantly less modeling effort.
3. Formal Logic Revision: The introduction of cATM, a streamlined logic that supports interval values and uncertainty, specifically tailored for querying quantitative metrics on MITRE campaign templates.
4. Comprehensive Validation: The framework was applied to all 23 MITRE Enterprise campaigns, generating a ranked list of campaigns based on their security indices.
5. Open-Source Artifact: A publicly available Python library and repository (DOI: 10.5281/zenodo.14193936) that implements the template generation, metric computation, and cATM logic.

Results

• Validation of Templates: For the Wocao and Dream Job campaigns, the security indices derived from the automatically generated "default" templates were found to be within the feasible range defined by the "hard" and "easy" templates and closely matched the manually constructed models.
• Campaign Comparison: The framework successfully differentiated campaigns. For instance, the Dream Job campaign was consistently ranked as having a lower security index (higher likelihood of success) than Wocao across default and hard templates, suggesting Dream Job is easier to execute.
• Robustness: Sensitivity analysis showed that the security index is robust to imperfect knowledge. Variations in the index were negligible (<10%) once a sufficient number of campaigns were included in the dataset, though early campaigns showed higher variability due to small sample sizes.
• Inversion Analysis: Comparing rankings generated by Hard, Easy, and Default templates revealed that while the absolute order of campaigns can shift (e.g., 37 inversions between Hard and Default rankings), the general trend of relative difficulty remains consistent for most campaigns.

Significance and Claims
The paper claims to provide cybersecurity practitioners with a transparent, accountable, and data-driven instrument for decision-making. By converting unstructured MITRE intelligence into quantitative security indices, the framework allows organizations to:

• Prioritize defense resources against the most likely attack campaigns.
• Compare the relative difficulty of different APT campaigns without requiring deep, manual modeling expertise for each new threat.
• Validate custom threat models against a data-driven baseline.

The authors emphasize that their method is "substantially lighter in modelling effort" than traditional manual approaches while capturing all quantitative relevant data. They note that the absolute values of the security index are less important than their relative ordering for prioritization. The paper concludes with a call for further validation by cybersecurity experts using more manually built models to ensure broader applicability, acknowledging that the current validation is limited to two specific campaigns.