In this paper, we enhance the machine-readable representation of the ATT&CK Groups knowledge base provided by MITRE in STIX 2.1 format to make available and queryable additional types of contextual information. Such information includes the motivations of activity groups, the countries they have originated from, and the sectors and countries they have targeted. We demonstrate how to utilize the enhanced model to construct intelligible queries to filter activity groups of interest and retrieve relevant tactical intelligence.
翻译:在本文中,我们加强了麻省理工学院以STIX 2.1格式提供的ATT&CK集团知识库的机器可读性,以提供可查询的额外类型的背景资料,其中包括活动集团的动机、它们来自的国家、它们所针对的部门和国家,我们展示了如何利用强化模型构建可理解查询,以过滤感兴趣的活动集团并检索相关的战术情报。