Amelie
Amelie is a student at FAU Erlangen-Nürnberg who deals with data-driven approaches to attack modeling. She has some hands-on experience as a working student supporting incident response and forensics.
Session
Threat modeling and attack-path analysis often rely on disconnected data sources and significant manual effort. While frameworks such as MITRE ATT&CK provide a structured knowledge base of adversary behavior, combining this information with vulnerabilities, attack flows, detection opportunities, and mitigations remains challenging.
This talk presents a master's thesis project that integrates MITRE ATT&CK v19 into a Neo4j graph database and enriches it with additional datasets, including CVE information, CVSS and EPSS scores and ATT&CK Flow data. Relationships between these datasets are modeled explicitly to enable attack-path generation and analysis.
The attack modeling approach combines an adapted Hidden Markov Model with a new technique categorization inspired by classical criminology questions such as who, what, where, when, why, and with what. Transition probabilities are derived from available attack-flow data, while context-based "enablers" eliminate technically infeasible attack steps. The remaining candidates are ranked using viability criteria derived from available vulnerability and technique data.
Examples will demonstrate how generated attack paths can be linked to exploitable vulnerabilities, relevant detections, mitigations, and potential forensic evidence sources for real-world applicability. The presentation will also discuss practical challenges encountered throughout the project, including incomplete metadata, limited transition knowledge, and the impact of data quality on modeling results.