RIALTO
SBIR Topic: Forensic Models of Cyberspace Behaviors (N19A-T021)
Internal Project Name: RIALTO
Dates of Contract: 3 JUN 2019 – 9 DEC 2019
Contract Number: ********C0350
Advanced Persistent Threats (APTs) use a variety of methods to disrupt and destroy cyber operations of their targets but, by performing a deeper examination of these methods, we can discern new information and connections between APTs to better protect against attacks. RIALTO is a tool designed to predict the cyber behavior of APTs by looking at the Tactics, Techniques, and Procedures (TTPs) used by similar APTs. By modeling their historical TTP use and applying advanced machine learning techniques, we can predict what kinds of attacks an APT may launch in the future.
In this project, we utilize TTPs documented in MITRE’s ATT&CK Framework to develop threat models which illuminate the hidden relationships and commonalities between separate APTs and allow us to predict possible future activity. By applying clustering techniques, we determine peer groups of similar APTs based on their unique combinations of TTP usage. These TTPs range broadly from highly technical methods such as DLL hijacking, to social engineering techniques like Spearphishing. In the future, we will soon expand this to include specific software usage and known targets. Using these peer groups and collaborative filtering techniques, we can develop “recommended” TTPs for an APT: TTPs that groups similar to them have used and that we can expect the new APT to use in the future.
Predicting future TTPs can enable targeted organizations to better prepare their networks and users for attacks. Software updates can be prioritized based on likely attack vectors and users can be alerted to specific potential methods attackers may use to gather their information.
These predictions are also incorporated in our “Attacker Search” capability in which the user can enter known information about a cyber threat (such as TTPs used, target, purpose, etc.) and receive a list of possible APTs that match that criteria. RIALTO incorporates trusted APT data and pulls the latest threat information from the MITRE ATT&CK database (attack.mitre.org) and MISP Threat Intelligence (misp-project.org). This feature enables users to quickly attribute attacks based on the historical footprint of APTs.
Technologies
- Recommender Systems: Collaborative filtering machine learning models use similarity between APTs to predict future behavior
- Cyber Early Warning: Provides advanced notice of future attacks that cyber defenders can use to prioritize defensive measures and software patching
- Cyber Attack Attribution: Find malicious cyber threat groups who’s past activities matches a user-defined profile
Differentiators
- Integration with MITRE ATT&CK Framework: ATT&CK is the standard for defining cyber-attack vectors and vulnerabilities. RIALTO speaks that language.
- APT Biographical Information Enrichment: ATT&CK’s data is enriched with other data about APTs such as their known targets, suspected state sponsors, and motives to improve prediction accuracy.
- Customizable Architecture: The system is designed to allow users to create their own sandbox of known APT and TTP data and run predictions based on these datasets which may not be publicly available.
Customers
- DOD
- Other government agencies
- Defense Industry Partners (anyone who may be targeted by an APT)
