Clustering APT Groups Through Cyber Threat Intelligence by Weighted Similarity Measurement

Advanced Persistent Threat (APT) groups pose significant cybersecurity threats due to their sophisticated and persistent nature. This study introduces a novel methodology to understand their collaborative patterns and shared objectives, which is crucial for developing robust defense mechanisms. We utilize MITRE ATT&CK Techniques, software, target nations, and industries as our primary features to understand the characteristics of APT groups. Since essential information is often buried within the unstructured data of Cyber Threat Intelligence (CTI) reports, we employ Natural Language Processing (NLP) and Named Entity Recognition (NER) to extract relevant data. To analyze and interpret the complex relationships between APT groups, we compute similarity among the features using weighted cosine similarity metrics and Machine Learning (ML) models, enhanced by feature crosses and feature selection strategies. Subsequently, hierarchical clustering is used to group APTs based on their similarity scores, helping to identify common behaviors and uncover deeper relationships. Our methodology demonstrates notable clustering performance, with a silhouette coefficient of 0.76, indicating strong intra-cluster similarity. The Adjusted Rand Index (ARI) of 0.63, though moderate, effectively measures agreement between our clustering and the ground truth. These metrics provide robust validation, surpassing commonly recognized benchmarks for effective clustering in cybersecurity. Our methodology successfully classifies 23 distinct APT groups into six clusters, highlighting the importance of techniques and industry features in the clustering process. Notably, techniques such as T1059 (Command and Scripting Interpreter) and T1036 (Masquerading) are prevalently deployed, observed in 18 out of 23 APT groups across all six clusters.