  The MITRE ATT&CK Framework provides a rich and actionable repository of
adversarial tactics, techniques, and procedures (TTP). However, this
information would be highly useful for attack diagnosis (i.e., forensics) and
mitigation (i.e., intrusion response) if we can reliably construct technique
associations that will enable predicting unobserved attack techniques based on
observed ones. In this paper, we present our statistical machine learning
analysis on APT and Software attack data reported by MITRE ATT&CK to infer the
technique clustering that represents the significant correlation that can be
used for technique prediction. Due to the complex multidimensional
relationships between techniques, many of the traditional clustering methods
could not obtain usable associations. Our approach, using hierarchical
clustering for inferring attack technique associations with 95% confidence,
provides statistically significant and explainable technique correlations. Our
analysis discovers 98 different technique associations (i.e., clusters) for
both APT and Software attacks. Our evaluation results show that 78% of the
techniques associated by our algorithm exhibit significant mutual information
that indicates reasonably high predictability.

Cryptography and Security;Artificial Intelligence