A technical characterization of APTs by leveraging public resources

• Published in: International journal of information security Vol. 22; no. 6; pp. 1567 - 1584
• Main Authors: González-Manzano, Lorena, de Fuentes, José M., Lombardi, Flavio, Ramos, Cristina
• Format: Journal Article
• Language: English
• Published: Berlin/Heidelberg Springer Berlin Heidelberg 01-12-2023; Springer Nature B.V
• Subjects: Coding and Information Theory; Communications Engineering; Computer Communication Networks; Computer Science; Cryptology; Cybersecurity; Malware; Management of Computing and Information Systems; Networks; Operating Systems; Regular Contribution; Tactics; APTs; MITRE ATT and CK; Malware; Advanced persistent threat
• ISSN: 1615-5262; 1615-5270
• DOI: 10.1007/s10207-023-00706-x

Advanced persistent threats (APTs) have rocketed over the last years. Unfortunately, their technical characterization is incomplete—it is still unclear if they are advanced usages of regular malware or a different form of malware. This is key to develop an effective cyberdefense. To address this issue, in this paper we analyze the techniques and tactics at stake for both regular and APT-linked malware. To enable reproducibility, our approach leverages only publicly available datasets and analysis tools. Our study involves 11,651 regular malware and 4686 APT-linked ones. Results show that both sets are not only statistically different, but can be automatically classified with
F
1 > 0.8 in most cases. Indeed, 8 tactics reach
F
1 > 0.9. Beyond the differences in techniques and tactics, our analysis shows thats actors behind APTs exhibit higher technical competence than those from non-APT malwares.