Balanced Attack Modeling: Connecting ATT&CK to Create Actionable Paths
Threat modeling and attack-path analysis often rely on disconnected data sources and significant manual effort. While frameworks such as MITRE ATT&CK provide a structured knowledge base of adversary behavior, combining this information with vulnerabilities, attack flows, detection opportunities, and mitigations remains challenging.
This talk presents a master's thesis project that integrates MITRE ATT&CK v19 into a Neo4j graph database and enriches it with additional datasets, including CVE information, CVSS and EPSS scores and ATT&CK Flow data. Relationships between these datasets are modeled explicitly to enable attack-path generation and analysis.
The attack modeling approach combines an adapted Hidden Markov Model with a new technique categorization inspired by classical criminology questions such as who, what, where, when, why, and with what. Transition probabilities are derived from available attack-flow data, while context-based "enablers" eliminate technically infeasible attack steps. The remaining candidates are ranked using viability criteria derived from available vulnerability and technique data.
Examples will demonstrate how generated attack paths can be linked to exploitable vulnerabilities, relevant detections, mitigations, and potential forensic evidence sources for real-world applicability. The presentation will also discuss practical challenges encountered throughout the project, including incomplete metadata, limited transition knowledge, and the impact of data quality on modeling results.
Overall this talk presents the design and implementation of an ATT&CK-based attack-modeling framework developed as part of a master's thesis. Rather than proposing a definitive solution to attack prediction, it explores how existing cybersecurity datasets can be consolidated within a graph database and combined with probabilistic methods to generate and analyze plausible attack paths.
This 25-minute presentation + 5-minute Q&A provides thoughts on
- How ATT&CK, vulnerability intelligence and attack flows can be integrated into a single graph-based knowledge model
- How probabilistic attack-path generation can be constrained using technical prerequisites and contextual information.
- How generated attack paths can support defensive activities such as threat modeling, control selection, and forensic investigations.
- Practical lessons learned when working with large public cybersecurity datasets.
- An assessment of the current limitations of ATT&CK enrichment, transition data availability, and data quality, and how these limitations affect analytical outcomes.
Amelie is a student at FAU Erlangen-Nürnberg who deals with data-driven approaches to attack modeling. She has some hands-on experience as a working student supporting incident response and forensics.