LiteATNet: Predicting APT Attack Using Transformer Model With MITRE ATT&CK Framework

With the increasing convergence of IT and OT environments in the Industrial Internet of Things (IIoT), attacks originating in IT systems are increasingly affecting OT assets, making network security in IIoT more critical than ever. Traditional intrusion detection systems often exhibit delays and struggle to effectively prevent advanced persistent threats (APTs). Therefore, understanding and predicting an attacker’s strategies is essential. However, existing attack prediction methods face challenges, such as dependence on specific network structures and the lack of standardized attack modeling. To address these issues, this paper proposes a Transformer-based lightweight attack prediction model, LiteATNet, which leverages the MITRE ATT&CK framework to model APT attacks in a standardized manner and predict attacker behavior at the level of specific techniques, independent of network structures. We also construct a dataset based on real APT attack cases. Experimental results demonstrate that our model effectively predicts attacker behavior and delivers competitive performance in multi-step intrusion scenarios.