Towards a definition of cyberspace tactics, techniques and procedures

Cybersecurity professionals often speak of tactics, techniques and procedures (TTPs) when describing the activities of threat actors, yet these terms are not as well defined in cybersecurity as in military doctrine. Systems that use artificial intelligence (AI) and machine learning (ML) to address cybersecurity problems could better determine adversarial intent and future actions by connecting sequences of actions to threat actor intent. In this paper, we define TTPs in relation to cybersecurity and present a model of TTPs for cyberspace operations that is useful to both humans and synthetic agents. We then describe how these can be applied to real-world cyberspace operations, using advanced persistent threat (APT) 28's Pawn Storm campaign as an exemplar. Finally, we show how we've approached the development of ML algorithms to provide predictive analytics based on large security datasets.

I. Introduction

The term TTP, which stands for tactics, techniques and procedures, is pervasive in the cybersecurity literature. Despite this ubiquity, there are no clear definitions allowing the community to differentiate tactics, techniques, and procedures. While ambiguity and imprecision when referring to TTPs is usually not problematic among security professionals, it is a significant impediment to using these concepts in autonomous systems. This problem manifested itself to the authors while developing actionable behavioral models of offensive cyberspace operations for an autonomous system. Our goal is to ground TTPs in a semantic representation that enables adversarial behavior modeling and autonomous decision-makinz. reasoning. and learning.