AIDE: Attack Inference Based on Heterogeneous Dependency Graphs with MITRE ATT&CK

The MITRE ATT&CK Framework provides a rich and actionable repository of adversarial tactics, techniques, and procedures (TTPs). By leveraging the associations among these techniques, we can infer unobserved techniques based on those have been observed. Current machine learning inference methods based on small-scale data face the following problems: "logical dependencies missing" and "complex associations missing." The former means that current association methods rely solely on the statistical dependencies between attack techniques while ignoring the logical dependencies involved in executing those techniques. The latter indicates that current inference methods simplify the complex associations between technologies based on statistical assumptions, failing to adequately capture the long-range and intricate real-world relationships between techniques. To address these problems, we propose an Attack Inference model based on heterogeneous DEpendency graphs (AIDE). First, we extract three types of logical dependencies: CVE, Pattern, and Conditional, which allows us to construct a heterogeneous dependency graph among the techniques, thus addressing the "logical dependencies missing" problem. Second, we employ Relation Graph Convolution Neural Networks (RGCN) to aggregate heterogeneous dependencies into representation vectors of the techniques. Finally, we utilize the sequence inference model Decoder, which excels at capturing implicit contextual associations, to infer unknown attacks, thus addressing the "complex associations missing" problem. Experiments conducted on real datasets demonstrate that our model significantly outperforms state-of-the-art baseline models in both hits@k and map@k metrics.