APT Cyber-attack Modelling : Building a General Model

Abstract

The global community continues to experience an increase in the scale, sophistication, and successful perpetration of cyber-attacks. As the quantity and value of electronic information have increased, so too have the efforts of criminals and other malicious actors who have embraced the Internet as a more anonymous, convenient, and profitable way of carrying out their activities. The systems are attacked more and more by single or multiple hacktivists, state sponsored hackers, cyber criminals, cyber terrorists, cyber spies, or cyber warfare warfighters. The cyber security approach requires a balance of cyber threat intelligence, real time cyber-attack detection and especially the cyber early warning ability. Threats in cyberspace are difficult to define, as it is hard to identify the source of attacks and the motives that drive them, or even to foresee the course of an attack as it unfolds. The identification of cyber threats is further complicated by the difficulty in defining the boundaries between national, international, public, and private interests. Because threats in cyberspace are global in nature and involve rapid technological developments, the struggle to respond them is ever-changing and increasingly complicated. Cyber-attack models describe the structure of an attack in different phases. They provide a means to conceptualize the different aspects and elements of an attack. However, it is important to understand that not all attacks must complete all phases to be successful, and the objective of the attack defines the structure of the attack. Different actors have built different cyber-attack models. Modeling is used to understand the different goals of cyber attackers. Attack models are based on attack targets and attack objectives. This paper analyzes different APT cyber-attack models and presents a general cyber-attack model.