# Analysis of Cyber-Intelligence Frameworks for AI Data Processing
## 3 Related Work: Cyber-Intelligence Frameworks
### Mitre Att&ck  
MITRE is a non-profit organisation founded in 1958 in the US that focuses on research, development, and innovation in information technology. As part of this work, the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) model [28] was developed in 2015 as a knowledge- and information-sharing hub for cyberattacks focused on the development and application of the concept of TTPs, whereby tactics represent why an attacker performs certain actions to carry out their objective, techniques represent how the attacker performs the actions, and procedures represent the detailed steps for the implementation of the techniques.  
This framework is increasingly deployed worldwide for its versatility and especially for its faithful representation of an attack based on observations of real attacks modelled with ATT&CK. The data implemented in the TTP database are drawn from intelligence reports produced by public and private entities around the world and have become a repository of great interest and utility for cybersecurity worldwide (see Figure 4).  
The backbone of the model consists of the representation of the TTPs by means of matrices in which the columns represent each of the defined tactics. The values of the matrix represent the techniques that can be applied in the analysis of an attack.  
Formally, considering the tactics as columns and the techniques as rows, the matrix M can be defined as M\({}_{\text{ij}}\), where \"i\" is the index of the technique, and \"j\" is the index of the tactic. So, for a particular cyberattack that uses certain techniques and, consequently, certain tactics, the value 1 can be assigned to the corresponding cells of the matrix, and 0 can be assigned to the others. For example, if technique 3 is used in tactic 2, then M\({}_{\text{32}}=1\).  
So, considering the elements of the matrix M, an event E can be represented as follows:  
\[\text{E}=\left((\text{M}_{\text{11}}),(\text{M}_{\text{12}}),(\text{M}_{\text {13}}),\ldots(\text{M}_{\text{mn}})\right)\]  
where m is the number of tactics involved, and n is the number of techniques involved in each tactic. There are different technical domains depending on the analysis objective: Enterprise, focused on attacks on entities; Mobile, referring to attacks on mobile environments; and ICS, referring to possible incidents in Industrial Control Systems. Likewise, each technical domain is different depending on whether it is applied to one operating system or another. The main applications of this framework are the detection and analysis of attacks, simulation, and Red Team in infrastructures and, in particular, CTI or threat intelligence.  
Finally, the presence of a taxonomy of TTPs has made it possible over time to bring together homogenised information on the parameters of different attack groups, the software involved, vulnerabilities according to their Common Vulnerability Exposed (CVE), etc. Currently, there is a scarcity of research focused on the use of AI in the Mitre Att&ck model. The most relevant is likely the study conducted in [29], which applied clustering algorithms to determine possible associations of TTPs. On the other hand, and beyond AI, there are studies on the prediction of possible sequences of TTPs using game theory [30] and Markov chains [31].  
Figure 4: Interest in Mitre Att&ck according to worldwide Google searches. Source: Google trends.