Scholarlink

<p>This paper presents a framework for analyzing and predicting cyber-attack chain risk using MITRE ATT&amp;CK-based sequential representations. Unlike conventional ATT&amp;CK-driven methods that primarily support descriptive mapping or static detection, the proposed framework explicitly models sequential dependencies and evolving risk in advanced persistent threat (APT) campaigns. Attack chains are first formalized under explicit construction rules and represented in structured forms suitable for learning. Probabilistic risk scores are then estimated for attack sub-chains using empirical occurrence probabilities, technique impact, and documented mitigation coverage, yielding continuous quantitative risk values. Building on these scores, we define two complementary machine-learning tasks: regression for continuous risk estimation and classification for top-k prioritization of the highest-risk chains. Sequence-aware models and conventional baselines are comparatively evaluated on real-world attack data. Results show that sequence-aware models provide strong performance for continuous risk estimation and ranking-oriented regression behavior, while a count-based MLP ensemble achieves the best overall performance for top-5 and top-10 high-risk chain prioritization. Bootstrap confidence intervals further indicate that the main classification and regression findings are stable under resampling. These findings demonstrate the practical value of combining probabilistic risk assessment with predictive modeling to support prioritization, early warning, and proactive cyber defense.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Categorization and risk assessment of cyber-attack chains: sub-chain approach using LSTM for predictive modeling

  • 期刊论文

  • 发表日期：

    2026年7月17日

查看全文
  • Parham Rajab nezhad,
  • Shahriar Bijani

摘要

This paper presents a framework for analyzing and predicting cyber-attack chain risk using MITRE ATT&CK-based sequential representations. Unlike conventional ATT&CK-driven methods that primarily support descriptive mapping or static detection, the proposed framework explicitly models sequential dependencies and evolving risk in advanced persistent threat (APT) campaigns. Attack chains are first formalized under explicit construction rules and represented in structured forms suitable for learning. Probabilistic risk scores are then estimated for attack sub-chains using empirical occurrence probabilities, technique impact, and documented mitigation coverage, yielding continuous quantitative risk values. Building on these scores, we define two complementary machine-learning tasks: regression for continuous risk estimation and classification for top-k prioritization of the highest-risk chains. Sequence-aware models and conventional baselines are comparatively evaluated on real-world attack data. Results show that sequence-aware models provide strong performance for continuous risk estimation and ranking-oriented regression behavior, while a count-based MLP ensemble achieves the best overall performance for top-5 and top-10 high-risk chain prioritization. Bootstrap confidence intervals further indicate that the main classification and regression findings are stable under resampling. These findings demonstrate the practical value of combining probabilistic risk assessment with predictive modeling to support prioritization, early warning, and proactive cyber defense.