From TTP to IoC: Advanced Persistent Graphs for Threat Hunting - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Journal Articles IEEE Transactions on Network and Service Management Year : 2021

From TTP to IoC: Advanced Persistent Graphs for Threat Hunting


Defenders fighting against Advanced Persistent Threats need to discover the propagation area of an adversary as quickly as possible. This discovery takes place through a phase of an incident response operation called Threat Hunting, where defenders track down attackers within the compromised network. In this article, we propose a formal model that dissects and abstracts elements of an attack, from both attacker and defender perspectives. This model leads to the construction of two persistent graphs on a common set of objects and components allowing for (1) an omniscient actor to compare, for both defender and attacker, the gap in knowledge and perceptions; (2) the attacker to become aware of the traces left on the targeted network; (3) the defender to improve the quality of Threat Hunting by identifying false-positives and adapting logging policy to be oriented for investigations. In this article, we challenge this model using an attack campaign mimicking APT29, a real-world threat, in a scenario designed by the MITRE Corporation. We measure the quality of the defensive architecture experimentally and then determine the most effective strategy to exploit data collected by the defender in order to extract actionable Cyber Threat Intelligence, and finally unveil the attacker.
Fichier principal
Vignette du fichier
Final version TNSM - From TTP to IoC - Advanced Persistent Graphs for Threat Hunting.pdf (3.14 Mo) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03131262 , version 1 (04-02-2021)



Aimad Berady, Mathieu Jaume, Valérie Viet Triem Tong, Gilles Guette. From TTP to IoC: Advanced Persistent Graphs for Threat Hunting. IEEE Transactions on Network and Service Management, 2021, Special Issue on Latest Developments for Security Management of Networks and Services, 18 (2), pp.1321 - 1333. ⟨10.1109/TNSM.2021.3056999⟩. ⟨hal-03131262⟩
1013 View
1235 Download



Gmail Mastodon Facebook X LinkedIn More