Cybersecurity Frameworks and Attack Modeling

4.1 Modern Day Threat Actors

Before diving into any framework or model, it is essential to understand who we are defending against. The popular image of a hacker — a young person in a dorm room running downloaded scripts — is dangerously outdated. The correct technical terms for adversaries in this domain are threat actors, attackers, or adversaries. The term "hackers" is informal and lacks professional grounding; in a technical course, precision in language matters. Just as a doctor would not call a disease "a bug," a security professional should not call an adversary "a hacker" — the language we use shapes how seriously we treat the problem.

4.1.1 The Three Qualities of Modern Threat Actors

Modern threat actors are defined by three qualities that combine into a formidable challenge for defenders:

Sophistication. Threat actors build cleverly crafted payloads designed to evade even the best endpoint detection and response (EDR) systems. EDR refers to software installed on endpoints (laptops, servers) that monitors for suspicious activity. Attackers know how to escape these systems. They develop domain generation algorithms (DGAs) — algorithms that produce rapidly changing domain names to avoid detection — and design payloads that slip past firewalls. These are skilled engineers using their abilities for malicious purposes.

The sophistication spectrum spans three broad tiers (from the textbook classification of intruder skill levels):

Kevin Mitnick, a famous threat actor arrested in the 1990s for multiple intrusions, later worked with the FBI to catch criminals — illustrating the level of skill these individuals possess. Modern master-level threat actors are often state-sponsored engineers with access to research budgets that rival those of legitimate software companies.

Resources. Some threat actors are nation-state actors, meaning they are backed by entire countries and their budgets. When a nation-state targets an organization, the resource asymmetry is enormous. They wield massive computing infrastructure for brute-forcing password hashes, cracking networks, and potentially leveraging quantum computing capabilities. A defender — whether a SOC (Security Operations Center) team member or a security engineer — is almost always understaffed, under-resourced, and working under time pressure. This asymmetry is a fundamental reality of cybersecurity.

The resource gap is not just about money. Nation-state groups (commonly designated as APT groups — Advanced Persistent Threat groups) have teams of engineers working full-time on a single target for months or years. Mandiant's landmark 2013 report on APT1 documented a Chinese military unit with dozens of personnel conducting sustained intrusion campaigns against over 140 organizations across multiple industries. Each operator had a defined role — reconnaissance specialists, exploit developers, infrastructure managers — working in shifts like a corporate engineering team.

Motivation. Motivation can be anything: financial gain, espionage, ideology, or personal grievance. The textbook classification of attacker motivations includes:

• Cyber criminals — motivated by financial reward (identity theft, credential theft, data ransoming)
• Hacktivists — motivated by social or political causes (website defacement, data leaks)
• State-sponsored organizations — motivated by espionage or sabotage (APTs)
• Others — motivated by technical challenge, peer reputation, or personal grievance

One real case involved a Cisco employee who was fired and, two days later, still had access to cloud resources. He logged back in, deleted virtual machines, and caused a WebEx outage. The motivation was personal revenge. Other motivations include stealing intellectual property (Google has accused Baidu of code theft), conducting fraudulent bank transactions, or disrupting critical infrastructure.

Real-world Domain Connection: The combination of sophistication, resources, and motivation in modern adversaries mirrors the preparation of professional criminals. In one anecdote shared by the professor, a burglary involved criminals who came armed with large rods, blocked the entire street, and were so well-prepared that confrontation was impossible. Cyber threat actors operate with the same level of preparation and planning. The cybersecurity community uses terms from military and intelligence analysis — threat intelligence, adversary profiles, campaign tracking — precisely because the challenge resembles a strategic conflict more than a technical troubleshooting exercise.

4.1.2 Key Terminology

4.2 The Intrusion Kill Chain Model

The Intrusion Kill Chain is a mental model — not a machine learning model, but a conceptual framework — for understanding how cyber attacks manifest. Developed by Lockheed Martin researchers Eric Hutchins, Michael Cloppert, and Rohan Amin around 2011–2013, it is an intelligence-driven cyber defense framework. The term "intelligence" here does not mean artificial intelligence; it means the right information that defenders lack to protect their systems and networks. The framework was published in the paper "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains" and has been widely adopted across the cybersecurity industry.

The kill chain is based on a military concept. In military operations, a "kill chain" describes the stages of targeting and engaging an adversary. Lockheed Martin adapted this concept to the cyber domain, providing a structured way to think about the attacker's journey from initial research to achieving their goal.

4.2.1 Core Concept: Seven Steps, Seven Puzzles

4.2.2 The Seven Steps

Each step in the kill chain represents a distinct phase of the attacker's operation. For each step, we examine what happens, what defenders can do, and where machine learning fits.

Step 1: Reconnaissance (Recon)

In the reconnaissance phase, the attacker conducts extensive research on the target. The target could be a human (a CEO, a politician), an organization, a server, or an application. This is analogous to criminals studying a bank before a heist — learning guard rotation schedules, opening times, safe change schedules, cash movement patterns, identities of guards, cashiers, and managers.

The companion text R1_01 classifies this phase under "target acquisition and information gathering" — where the attacker identifies and characterizes the target systems using publicly available information, both technical and non-technical, and uses network exploration tools to map target resources.

For human targets, attackers study LinkedIn profiles, Twitter accounts, digital footprints, children's schools, spouses' shopping patterns, and personal interests. Many people use their children's names or pet names as passwords, so personal research directly aids password cracking. This is a form of social engineering — using non-technical methods such as lying, trickery, or bribery to extract information from a human being.

For server targets, attackers scan IP addresses and ports. The entire IPv4 address space (approximately 4.3 billion addresses) is continuously scanned by automated tools. Tools like ZMap can scan the entire IPv4 space in roughly an hour. Eighty to ninety percent of internet traffic may be this kind of scanning noise.

Attackers may not even need to touch the target directly. Auxiliary databases and public records — breach databases, WHOIS records, DNS zone files, certificate transparency logs — can provide substantial information. The reconnaissance phase is about basic research, identification, and target selection.

Step 2: Weaponization

Once the attacker has gathered sufficient intelligence about the target, they prepare a carefully crafted payload — the weapon. If reconnaissance revealed the target uses an old Android phone with WhatsApp, the attacker prepares a malicious APK file tailored to that vulnerability. If the target is a senior citizen who is not tech-savvy, the attacker might craft a WhatsApp message about a gold loan offer.

The weapon could be a PDF, a link, a message, a file, or a USB drive — but it is specifically designed for the target audience based on reconnaissance findings. The companion text R1_06 describes how modern attack kits (crimeware) "include a variety of propagation mechanisms and payload modules that even novices can combine, select, and deploy." The Zeus crimeware toolkit is a prominent example, used to generate stealthy malware that facilitates banking credential theft.

Critical defender limitation: Defenders generally cannot detect weaponization as it happens. The weapon is being prepared on the attacker's infrastructure, outside the defender's visibility. This is analogous to scientists developing a new type of bomb — no one knows how to defend against it until it is used and analyzed. However, if the weapon uses publicly known techniques, there may be some defensive opportunity through threat intelligence sharing.

Attackers also face costs in building weapons and may reuse existing tools and payloads rather than creating new ones for every operation. This reuse creates opportunities for defenders through signature-based detection — but only after the weapon has been used at least once.

Step 3: Delivery

Delivery is the mechanism by which the weapon reaches the target. This could be an email with a malicious attachment, a WhatsApp message with a link, a phishing website, a LinkedIn message, a USB drive left in a parking lot, or any other transmission method. The companion text R1_06 classifies delivery under three broad propagation mechanisms: infected content (viruses), vulnerability exploit (worms), and social engineering (spam, Trojans, phishing).

Defenders have significant opportunity in the delivery phase:

Microsoft Word and Excel now open downloaded documents in read-only mode by default, requiring explicit user action to enable editing — a lesson learned from years of macro-based attacks.

Step 4: Exploitation

Exploitation is when the weapon gets triggered — detonated. The victim clicks the link, opens the file, inserts the USB drive, or takes whatever action activates the payload. The malware executes and begins its work.

The boundary between delivery and exploitation is often blurred in practice. These discrete steps exist for conceptual clarity; real attacks may combine or split them differently.

This is where machine learning becomes critical. Traditional signature-based detection — which relies on known patterns of malicious code — completely fails against zero-day exploits and novel payloads. The companion text R1_08 defines two main analysis approaches for intrusion detection:

• Signature/heuristic detection: Uses known malicious data patterns to identify attacks. Effective against known threats, but unable to detect zero-day attacks.
• Anomaly detection: Establishes a model of normal behavior and flags deviations. Can detect unknown attacks but suffers from higher false-positive rates.

ML-based techniques are needed to detect:

• Malicious URLs (phishing and malware distribution sites)
• Malware binaries (including polymorphic variants that change their appearance with each infection)
• Brute-force attempts against authentication systems
• Privilege escalation (an attacker gaining higher access rights on a compromised system)

Step 5: Installation

Once the exploit triggers, the malware installs itself on the target system. Installation does not necessarily mean writing to the hard drive — some malware, known as fileless malware, exists only in memory, making it harder to detect through traditional file-scanning methods.

Attackers use various techniques to maintain persistence (the ability to survive system reboots and remain on the compromised system):

• Creating innocent-looking registry entries
• Disguising themselves as familiar processes (e.g., renaming malware to "calculator.exe")
• Creating hidden user accounts that blend in with legitimate accounts
• Installing rootkits — programs that maintain covert access with administrator privileges while hiding evidence of their presence

The companion text R1_06 classifies rootkits by their stealth level: persistent (survives reboots), memory-based (no persistent code, cannot survive reboot but harder to detect), user-mode (intercepts API calls), kernel-mode (modifies the operating system kernel), and virtual-machine-based (installs a hypervisor below the OS, making it invisible to all software above). Each generation represents an escalation in the arms race between attackers and defenders.

In heavily regulated industries (banks, financial services, defense), endpoint lockdown is strict. Administrators maintain inventories of approved software and block or flag unauthorized installations. However, even approved software can be compromised through supply chain attacks — where a legitimate dependency (a pip package, a Java library, an AI model) gets hijacked and replaced with a malicious version.

Step 6: Command and Control (C2)

After installation, the malware needs to communicate with the attacker's infrastructure to receive additional instructions. This is the command and control phase. Attackers deliberately keep their initial payload small and innocuous to avoid tripping any alarms — IDS (Intrusion Detection System) alerts, EDR alerts, or SOC alerts.

The companion text R1_06 explains that the C2 mechanism distinguishes bots from worms. A worm propagates and activates itself; a bot is controlled by a command-and-control server network. Early C2 used IRC (Internet Relay Chat) channels; modern botnets use covert communication via HTTP or peer-to-peer protocols. Some malware families use Domain Generation Algorithms (DGAs) to automatically generate large numbers of server domain names, making it nearly impossible to block all C2 channels.

Detecting beaconing requires correlating network traffic patterns — frequency, timing, destination, payload size — and building ML models to identify anomalous communication. This topic will be covered in depth later in the course (sessions 13–14 on Domain Generation Algorithms).

Step 7: Actions on Objective

This is the final stage — the attacker's goal. If the defender has not stopped the attack by this point, it is game over. The attacker has hands-on keyboard access and is actively pursuing their objective:

• Deleting virtual machines (disgruntled employee case)
• Stealing intellectual property (Google vs. Baidu case)
• Conducting fraudulent bank transactions
• Deploying ransomware (encrypting the victim's data and demanding payment for the decryption key)
• Exfiltrating sensitive data
• Using compromised resources for crypto mining

The longer the adversary maintains access, the greater the impact. Active Directory — the system that manages user accounts, permissions, and resources across an enterprise network — is often considered the "holy grail" for attackers. If Active Directory is compromised, the attacker can access virtually any machine, user account, or resource in the organization.

Critical statistic: The average time to detect modern APT attacks can be months. Attackers move silently and patiently through the network, and defenders must analyze months of network traffic to identify the intrusion. The companion text R1_06 notes that APT attacks "differ from other types of attack by their careful target selection, and persistent, often stealthy, intrusion efforts over extended periods."

4.2.3 Defense at Each Kill Chain Phase

4.3 The MITRE ATT&CK Model

The Intrusion Kill Chain provides the big picture — the forest. The MITRE ATT&CK model provides the trees — granular detail on exactly how each phase of an attack unfolds. Where the kill chain has seven high-level steps, MITRE ATT&CK "double clicks" on each step to reveal the specific tactics and techniques attackers use. The MITRE Corporation, a not-for-profit organization that operates federally funded research and development centers, created the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework based on real-world observations of adversary behavior.

4.3.1 Tactics, Techniques, and Procedures (TTPs)

Think of it this way: if tactics are destinations on a map ("I want to gain initial access"), techniques are the roads to get there ("I'll send a spear-phishing email"), and procedures are the turn-by-turn directions ("I'll research the target's LinkedIn, craft an email about a job offer, attach a malicious PDF titled 'Job_Description.pdf'...").

The MITRE ATT&CK framework is organized as a matrix with tactics as columns and techniques as rows. There are separate matrices for different environments:

• Enterprise — Windows, macOS, Linux, Cloud, Network, Containers
• Mobile — Android, iOS
• ICS (Industrial Control Systems) — for infrastructure like power grids and manufacturing

The enterprise matrix includes 14 tactics (as of the current version): Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Each tactic contains numerous techniques — for example, "Initial Access" includes techniques like spear-phishing attachments, exploitation of public-facing applications, and supply chain compromise. The framework is continuously updated as new attack methods are discovered and documented.

4.3.2 Why Granularity Matters

The more granular your understanding of attack techniques, the better your defenses. If you know that a specific attack uses "lock screen bypass," you can build a model specifically for that. If you know another uses "SIM swap," you can target that technique. Supply chain compromises, credential leakage through hardcoded secrets in GitHub repositories — each has its own detection and mitigation approach.

4.3.3 Programmatic Access to MITRE ATT&CK Data

The entire MITRE ATT&CK dataset is available as a Python module for programmatic access. This enables:

• Querying techniques and tactics for each kill chain phase
• Building threat models based on real attack data
• Cross-correlating with machine learning models
• Running Jupyter notebooks that interact with the data

Real-world: SOC teams can integrate this data into their platforms — whether using Splunk, the open-source ELK stack (Elasticsearch, Logstash, Kibana), or custom Grafana dashboards — to build detection models grounded in real-world attack intelligence. The key value of programmatic access is automation: instead of manually checking hundreds of techniques, a script can compare your organization's log coverage against the ATT&CK matrix and identify gaps automatically.

4.4 Cyber Threat Intelligence (CTI)

Cyber Threat Intelligence is the collection and analysis of real-world attack data mapped to frameworks like MITRE ATT&CK. While the kill chain provides the skeleton and MITRE ATT&CK provides the technique catalog, CTI provides the actual case studies. Think of it as the difference between studying anatomy from a textbook (framework) and learning surgery from a hospital (real cases). Both are necessary; neither alone is sufficient.

4.4.1 APT Groups

The companion text R1_06 defines APTs as attacks characterized by three qualities:

Named APT groups referenced in the lecture include:

• APT1 — the first named advanced persistent threat group, attributed to China's Second Bureau of the People's Liberation Army. Known for specific techniques in network intrusion and data exfiltration. The Mandiant 2013 report documented APT1 as conducting campaigns against over 140 organizations across industries over a seven-year period.
• Cobalt Group — known for its DGA (Domain Generation Algorithm) usage and targeting of financial institutions
• Dark Caracal — a group conducting mobile and desktop espionage campaigns, often using social engineering
• Dark Hotel — a group targeting luxury hotel guests through compromised hotel Wi-Fi networks, primarily for espionage

4.4.2 Campaigns and Case Studies

Real attacks are documented as campaigns in the CTI framework. Each campaign maps specific combinations of tactics and techniques to real-world outcomes, providing defenders with actionable intelligence about what to look for in their own environments.

Examples of documented campaigns include:

• Ukrainian electric power attack — a state-sponsored attack that disrupted power distribution, demonstrating the potential for cyber attacks to cause physical infrastructure damage
• Polish VIP attack — targeted espionage against government officials
• Supply chain attacks — compromising legitimate software update mechanisms to distribute malware
• AI-orchestrated campaigns — emerging threats where attackers use AI to craft more convincing phishing messages or to automate reconnaissance
• Salesforce data exploitation — involving cloud application integration, file and directory discovery, phishing, proxy hopping, and established account abuse

4.4.3 Hands-On Data Access

The MITRE ATT&CK data is available through Python libraries and can be explored programmatically. Students are encouraged to:

• Browse the MITRE ATT&CK website to get immersed in the domain
• Use Jupyter notebooks (shared via GitHub) to interact with the data
• Build threat models for their own organizations
• Cross-reference with network logs and security events

The practical value of programmatic CTI access is the ability to automate gap analysis: given your organization's current log sources and detection rules, what percentage of known ATT&CK techniques can you detect? This coverage metric drives prioritized investment in security tooling.

4.5 Defense in Depth and the Silver Bullet Fallacy

4.5.1 Layered Defense Strategy

The concept of defense in depth is central to cybersecurity strategy. It means deploying multiple layers of defense at every phase of the kill chain, so that if one layer fails, the next has a chance to catch the threat. The companion text R1_01 formally defines "layering" as "the use of multiple, overlapping protection approaches addressing the people, technology, and operational aspects of information systems."

The companion text R1_01 provides a useful visualization: security risk is a function of two dimensions — the attack surface (how large and exposed the system is) and the depth of layering (how many defensive layers protect it). A large attack surface with shallow layering is high risk. A small attack surface with deep layering is low risk. Organizations should aim to reduce the attack surface while simultaneously increasing defensive depth.

In practical terms, defense in depth for a kill-chain-based security program might look like:

4.5.2 The Silver Bullet Fallacy

This has practical implications for ML model deployment:

• No ML model will be perfect on deployment
• Models need continuous retraining as attackers adapt (the adversary learns your defenses and modifies their behavior)
• Multiple models covering different aspects of the same threat provide better coverage than a single model
• The cost and complexity of security scales with the depth of defense required
• The defender's challenge is prioritization: with limited budget, which layers provide the most risk reduction per dollar spent?

4.6 Machine Learning Opportunities Across the Kill Chain

4.6.1 ML Applications by Kill Chain Phase

A recurring theme throughout the lecture is where machine learning can contribute to defense at each kill chain phase. The companion texts T1_01 and R3_01 both emphasize that ML's primary value in security falls into two broad categories:

• Pattern recognition — discovering explicit or latent characteristics in data and using them to classify new observations (e.g., spam detection, malware classification)
• Anomaly detection — establishing a model of normal behavior and flagging deviations (e.g., network outlier detection, beaconing identification)

The companion text T1_01 notes: "The line differentiating pattern recognition and anomaly detection is sometimes blurry, but each task has a distinctly different goal." Understanding which category applies to each kill chain phase helps in selecting the right ML approach.

4.6.2 Data Sources for ML Security Models

The quality and realism of training data directly determines model effectiveness. The companion text R3_01 emphasizes that "data is the fuel that drives the machine learning engine" and that data can be structured (mapped to identifiable column headers), unstructured (no identifiable data model), or semi-structured (a mix).

The companion texts identify several data source categories relevant to security ML:

• Network traffic logs — packet captures, NetFlow data, DNS logs (for beaconing, scanning, and C2 detection)
• Endpoint telemetry — process creation logs, file system events, registry changes (for installation and persistence detection)
• Email metadata and content — sender, recipient, subject, body, attachments (for phishing and spam detection)
• Application logs — authentication events, API calls, database queries (for insider threat and privilege escalation detection)
• Threat intelligence feeds — known malicious IPs, domains, file hashes (for enrichment of ML features)

4.7 Practical Guidance and Resources

4.7.1 Lab Environment Setup

For hands-on experimentation with security data and ML models:

• Use a virtual machine (VirtualBox, VMware, or similar) to create an isolated environment
• Any operating system (Ubuntu, Windows) works — the code is all Python
• This isolates learning activities from your work environment
• No real malware is used in the course — only benign demo data
• Some antivirus software may flag benign samples due to signature matches; using a VM avoids this issue

4.7.2 Recommended Reading

The lecture references several foundational texts that provide complementary perspectives:

• Sun Tzu's Art of War — a Chinese military treatise, centuries old, on preparation and strategy. Directly applicable to understanding the defender's mindset against well-prepared adversaries. Key lesson: "Know thy enemy and know yourself; in a hundred battles, you will never be defeated."
• Kautilya's Arthasastra — an ancient Indian text covering statecraft and military strategy, including espionage and counter-intelligence concepts relevant to adversarial thinking.
• Lockheed Martin's Intrusion Kill Chain paper — the original framework paper, publicly available. Essential reading for understanding the theoretical foundation of this lecture.
• MITRE ATT&CK website — the complete matrix of tactics and techniques, continuously updated.
• ML Security textbook (referenced in the recommended reading list) — contains foundational examples, though the course does not follow its order.

The companion text T1_01 ("Why Machine Learning and Security?") provides an excellent introduction to the intersection of ML and cybersecurity, including a detailed spam-fighting case study that walks through multiple ML approaches (blacklists, fuzzy hashing, Naive Bayes) with real code and real data.

4.7.3 GitHub Repositories

Complete code repositories with examples for the course are available publicly, covering:

• MITRE ATT&CK data exploration and threat modeling
• Spam detectors
• Malware detection models
• Database access anomaly detection
• DGA detection
• Network profiling

Students are encouraged to download, experiment, provide feedback, and submit pull requests.

Exam Guidance Summary

• The seven steps of the Intrusion Kill Chain are core material — understand each step, what happens at each, and what defensive opportunities exist at each phase. Be prepared to list all seven steps and explain the principle of "earlier detection is better."
• The relationship between the kill chain and MITRE ATT&CK is important: the kill chain is the high-level skeleton; MITRE ATT&CK provides granular detail on techniques. Understand TTPs (Tactics, Techniques, Procedures) and how they relate.
• Know the terminology: threat actors, adversaries, TTPs, APT, EDR, DGA, beaconing, defense in depth, silver bullet. Definitions may appear as direct questions.
• Defense in depth is a key concept — no single solution works; layered defenses are required. Understand the silver bullet fallacy and its implications.
• ML opportunities exist at each kill chain phase, with the strongest case from exploitation onward. Know the two broad categories: pattern recognition and anomaly detection.
• Real-world case studies (Stuxnet, crypto mining on Docker, disgruntled employee, traffic challan scam, APT1) illustrate how the theoretical framework applies to actual attacks. Be prepared to identify which kill chain phase a given scenario belongs to.
• The course will build ML models for each kill chain phase throughout the semester — this lecture provides the conceptual foundation.

Key Industry Applications

• SOC Operations — MITRE ATT&CK data can be integrated into Splunk, ELK stack, or Grafana dashboards for real-time threat detection. SOC analysts use ATT&CK mappings to prioritize alert triage and investigate incidents systematically.
• Threat Intelligence — APT group profiles and campaign data provide actionable intelligence for organizational defense planning. CTI feeds are used to enrich security alerts with context about known adversary behavior.
• EDR Systems — Endpoint detection and response tools use behavioral analysis (increasingly ML-based) to detect threats that evade signatures. Modern EDR products combine process monitoring, file integrity checking, and network traffic analysis.
• Network Security — Beaconing detection and DGA identification are active areas of ML research and deployment. These models analyze DNS query patterns, HTTP traffic periodicity, and domain name linguistic features.
• Supply Chain Security — Detecting compromised dependencies in software supply chains is a growing industry concern. ML models can analyze package behavior, network communications, and code changes to identify anomalies.
• Financial Services — Heavily regulated industries (banks, defense) implement strict endpoint lockdown, software inventories, and approved-software lists. ML-based fraud detection analyzes transaction patterns for anomalous behavior.
• Cloud Security — Misconfigured cloud services (like Docker containers with exposed ports) represent a significant and growing attack surface. Cloud-native security tools increasingly use ML to detect misconfigurations and unauthorized access.