Anticipating the Evolution of APT Variants Using Generative AI and Reinforcement Learning

The cyber threat landscape is witnessing a diverse and widespread evolution in threat actors' strategies, especially at the level of Advanced Persistent Threats (APTs). Current solutions often fall behind in detecting these new and sophisticated attacks due to their stealthy nature and the evolving use of variant attack methods. The evolution of APT variants causes challenges by introducing inconsiderate attack patterns, for which most security defense systems are not prepared. In this paper, we introduce APTMORPH, an automated solution that generates APT variants by anticipating the next <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$n$</tex> variant techniques that can occur using Generative Adversarial Network (GAN) and Reinforcement Learning (RL). APTMORPH is trained using APTs from the MITRE ATT&CK knowledge base to learn, augment, and evaluate the security context of anticipated techniques. APTMORPH integrates an Adversarial Learning Loop, which consists of two modules: a Technique Generator and a Technique Discriminator. The generator generates the possible variant techniques while the discriminator ensures only the most relevant techniques remain. The process is also supported by a Security Context Evaluator using a Reinforcement Learning Loop via a Monte-Carlo rollouts method. Assisted with threat hunting practitioners, we built a Proof of Concept and conducted a rigorous evaluation using global APT campaigns, public campaigns from MITRE ATT&CK, public Cyber Threat Intelligence (CTI) reports, and an APTs dataset. The obtained results confirm that APTMORPH can generate relevant variants of real-world APT campaigns with ≈90% technique similarity ratio, ≈83% common tactic ratio, and ≈80% similarity with public CTI. APTMORPH'S Demo: https://youtu.be/pObO4uJv3XY