Analysis and Characterization of Cyber Threats Leveraging the MITRE ATT&CK Database

Abstract - MITRE ATT&CK is a detailed knowledge base of adversary TTPs, based on real-world cyber-attack scenarios. It's widely used throughout government, academia, and industry. It has become a cornerstone for threat modeling, risk assessment, and developing defense strategies. Since the topics of the framework have been highly applied to these fields, comprehensive statistical analysis of this dataset holds the need to be able to uncover actionable insights. This work therefore fills this gap by systematically extracting, analyzing, and characterizing insights from the knowledge base of statistical insights in the MITRE ATT&CK threat database. A hierarchical analysis is executed, starting at the level of threat profiles then down to very specific techniques captured in the cataloged database; the findings recommend improvements in strengthening the cybersecurity posture in enterprises, in ICS as well as the mobile infrastructures. It is intended to give a better view of the data and provide guidance for further investigations in support of the development of robust, data-driven security strategies.