کنفرانس بین المللی فناوری اطلاعات و دانش

صفحه اصلی / شانزدهمین کنفرانس بین المللی فناوری اطلاعات و دانش

Intent-Based Classification of Multi-Stage Cyber Attacks Using Attacker TTPs and Machine Learning

نویسندگان :

Fatemeh Imanimehr¹ Hamed Ebrahimi²

1- پژوهشگاه ارتباطات و فناوری اطلاعات 2- پژوهشگاه ارتباطات و فناوری اطلاعات

کلمات کلیدی :

Multi-Stage Attack،Machine Learning-Based Classification،Adversary TTPs

چکیده :

In this paper, we propose a novel method for classifying multi-stage adversarial attacks based on attacker intent and objectives, leveraging the structured knowledge of adversary behaviors encapsulated in the MITRE ATT\&CK framework. The proposed approach processes outputs from Security Information and Event Management (SIEM) systems and analyzes observed Tactics, Techniques, and Procedures (TTPs) to infer attacker intent through machine learning–based classification. We evaluate four widely used classifiers and select Random Forest as the optimal model based on standard performance metrics. Experimental results demonstrate that the Random Forest classifier accurately identifies attacker intent with high precision and robust performance.