The landscape of cyber threats grows more complex by the day. Advanced Persistent Threats carry out attack campaigns - e.g. operations Dream Job, Wocao, and WannaCry - against which cybersecurity practitioners must defend. To prioritise which of these to defend against, cybersecurity experts must be equipped with the right toolbox to evaluate the most threatening ones. In particular, they would strongly benefit from (a) an estimation of the likelihood values for each attack recorded in the wild, and (b) transparently operationalising these values to compare campaigns quantitatively. Security experts could then perform transparent and accountable quantitatively-informed decisions. Here we construct such a framework: (1) quantifying the likelihood of attack campaigns via data-driven procedures on the MITRE knowledge-base, (2) introducing a methodology for automatic modelling of MITRE intelligence data, that captures any attack campaign via template attack tree models, and (3) proposing an open-source tool to perform these comparisons based on the cATM logic. Finally, we quantify the likelihood of all MITRE Enterprise campaigns, and compare the likelihood of the Wocao and Dream Job MITRE campaigns - generated with our proposed approach - against manually-built attack tree models. We demonstrate how our methodology is substantially lighter in modelling effort, and capable of capturing all the quantitative relevant data.

翻译：网络威胁格局日益复杂。高级持续性威胁（APT）组织会发起攻击活动——例如Dream Job、Wocao和WannaCry等行动——网络安全从业者必须对此进行防御。为了确定防御的优先级，网络安全专家需要配备合适的工具箱来评估最具威胁性的攻击活动。具体而言，他们将从以下两方面显著受益：（a）对实际记录中每次攻击的发生概率进行估计，以及（b）以透明化的方式运用这些概率值对攻击活动进行定量比较。这样，安全专家便能做出透明、可追溯且基于定量信息的决策。本文构建了这样一个框架：（1）通过对MITRE知识库进行数据驱动分析来量化攻击活动的发生概率；（2）提出一种自动建模MITRE情报数据的方法，通过模板化攻击树模型捕捉任意攻击活动；（3）开发基于cATM逻辑的开源工具以执行上述比较分析。最后，我们量化了所有MITRE企业级攻击活动的发生概率，并将通过本方法生成的Wocao和Dream Job攻击活动的概率估计值与人工构建的攻击树模型结果进行对比。实验表明，我们所提出的方法能大幅降低建模工作量，并能完整捕获所有定量相关数据。