A technical characterization of APTs by leveraging public resources

González Manzano, Lorena; Fuentes García-Romero de Tejada, José María de; Lombardi, Flavio; Ramos, Cristina

Publication:
A technical characterization of APTs by leveraging public resources

dc.affiliation.dpto	UC3M. Departamento de Informática	es
dc.affiliation.grupoinv	UC3M. Grupo de Investigación: COSEC (Computer SECurity Lab)	es
dc.contributor.author	González Manzano, Lorena
dc.contributor.author	Fuentes García-Romero de Tejada, José María de
dc.contributor.author	Lombardi, Flavio
dc.contributor.author	Ramos, Cristina
dc.contributor.funder	Comunidad de Madrid	es
dc.contributor.funder	European Commission	en
dc.contributor.funder	Ministerio de Ciencia e Innovación (España)	es
dc.contributor.funder	Universidad Carlos III de Madrid	es
dc.date.accessioned	2023-11-16T10:34:25Z
dc.date.available	2023-11-16T10:34:25Z
dc.date.issued	2023-06-15
dc.description.abstract	Advanced persistent threats (APTs) have rocketed over the last years. Unfortunately, their technical characterization is incomplete—it is still unclear if they are advanced usages of regular malware or a different form of malware. This is key to develop an effective cyberdefense. To address this issue, in this paper we analyze the techniques and tactics at stake for both regular and APT-linked malware. To enable reproducibility, our approach leverages only publicly available datasets and analysis tools. Our study involves 11,651 regular malware and 4686 APT-linked ones. Results show that both sets are not only statistically different, but can be automatically classified with F1 > 0.8 in most cases. Indeed, 8 tactics reach F1 > 0.9. Beyond the differences in techniques and tactics, our analysis shows thats actors behind APTs exhibit higher technical competence than those from non-APT malwares.	en
dc.description.sponsorship	This work has been partially supported by grant DEPROFAKE-CM-UC3M funded by UC3M and the Government of Madrid (CAM); by CAM through Project CYNAMON, Grant No. P2018/TCS-4566-CM, co-funded with ERDF; by Ministry of Science and Innovation of Spain by grant PID2019-111429RB-C21; by TRUSTaWARE Project EU HORIZON 2020 Research and Innovation Programme GA No 101021377 trustaware.eu; and by TAILOR Project EU HORIZON 2020 Research and Innovation Programme GA No 952215 tailor-network.eu. Funding for APC: Universidad Carlos III de Madrid (Read & Publish Agreement CRUE-CSIC 2023).	en
dc.identifier.bibliographicCitation	González-Manzano, L., de Fuentes, J.M., Lombardi, F. et al. A technical characterization of APTs by leveraging public resources. Int. J. Inf. Secur. 22, 1567–1584 (2023). https://doi.org/10.1007/s10207-023-00706-x	en
dc.identifier.doi	https://doi.org/10.1007/s10207-023-00706-x
dc.identifier.issn	1615-5262
dc.identifier.publicationfirstpage	1567
dc.identifier.publicationlastpage	1584
dc.identifier.publicationtitle	International Journal of Information Security	en
dc.identifier.publicationvolume	22
dc.identifier.uri	https://hdl.handle.net/10016/38885
dc.identifier.uxxi	AR/0000033131
dc.language.iso	eng
dc.publisher	Springer	es
dc.relation.projectID	Comunidad de Madrid. S2018/TCS-4566	es
dc.relation.projectID	Gobierno de España. PID2019-111429RB-C21	es
dc.relation.projectID	info:eu-repo/grantAgreement/EC/101021377	es
dc.relation.projectID	Comunidad de Madrid. DEPROFAKE-CM-UC3M	es
dc.rights	© 2023, The Author(s)
dc.rights	Atribución 3.0 España
dc.rights.accessRights	open access	en
dc.rights.uri	http://creativecommons.org/licenses/by/3.0/es/
dc.subject.eciencia	Informática	es
dc.subject.other	advanced persistent threat	en
dc.subject.other	apts	en
dc.subject.other	malware	en
dc.subject.other	mitre att and ck	en
dc.title	A technical characterization of APTs by leveraging public resources	en
dc.type	research article	*
dc.type.hasVersion	VoR	*
dspace.entity.type	Publication