International Conference on Information and Knowledge Technology

Home / شانزدهمین کنفرانس بین المللی فناوری اطلاعات و دانش

Intent-Based Classification of Multi-Stage Cyber Attacks Using Attacker TTPs and Machine Learning

Authors :

Fatemeh Imanimehr¹ Hamed Ebrahimi²

1- پژوهشگاه ارتباطات و فناوری اطلاعات 2- پژوهشگاه ارتباطات و فناوری اطلاعات

Keywords :

Multi-Stage Attack،Machine Learning-Based Classification،Adversary TTPs

Abstract :

In this paper, we propose a novel method for classifying multi-stage adversarial attacks based on attacker intent and objectives, leveraging the structured knowledge of adversary behaviors encapsulated in the MITRE ATT\&CK framework. The proposed approach processes outputs from Security Information and Event Management (SIEM) systems and analyzes observed Tactics, Techniques, and Procedures (TTPs) to infer attacker intent through machine learning–based classification. We evaluate four widely used classifiers and select Random Forest as the optimal model based on standard performance metrics. Experimental results demonstrate that the Random Forest classifier accurately identifies attacker intent with high precision and robust performance.