Integrating Tree Structures with the MITRE ATT&CK Framework for APT Detection

Advanced Persistent Threats (APTs) have become a major information security concern for modern organizations. Due to APT attacks' complexity and evolving nature, their detection remains challenging. This paper proposes an APT pattern tree construction algorithm based on the MITRE ATT&CK techniques and the concept of kill chain model stages. The APT pattern tree is constructed progressively using the different attack techniques identified in real-world databases. The successful construction of these APT pattern trees can examine the attack combinations forming the APT and potentially significantly improve APT detection capabilities, forensic investigations, and early warning systems. The proposed approach effectively helps enhance computer systems' security and reliability.