# Analysis of Cyber-Intelligence Frameworks for AI Data Processing
## 3 Related Work: Cyber-Intelligence Frameworks
### Cyberkill Chain  
Focused mainly on APT attacks, this framework has had a strong impact on the field of cyber intelligence since its publication in 2010 [24]. It was developed by the US company _Lockheed Martin_ and tries to represent a series of steps that an attacker must execute to reach his or her final objective based on the F2T2 EA (Find, Fix, Track, Target, Engage, Assess) concept, a methodology of reference in the US military doctrine [25] (see Figure 3). Cyberkill Chain establishes seven steps, consisting of (1) Reconnaissance: getting to know the victim through noninvasive techniques; (2) Weaponisation: generating the malicious payload to be delivered; (3) Delivery: delivering the artefact developed or acquired in the previous step; (4) Exploitation: achieving code execution on the victim's system through the exploitation of a vulnerability or other means; (5) Installation: installing the final piece of malware; (6) Command and Control (C2): establishing a channel to communicate with the malware on the victim's system; and (7) Actions on Targets: achieving the goal of the attack, having gained full access and communication.  
This chain is useful because it provides a structured and systematic approach to understanding and addressing cyberattacks from start to finish, making it easier to identify threats and implement strategies to defend against them. Its advantages include:  
* Early warning or prevention, analysing potential weaknesses in the technological infrastructure at each stage of a potential attack before it can take place.
* Optimisation of resources, focusing investments and efforts on the most vulnerable stages in the infrastructure.
* Raising awareness of workers who do not have knowledge of cybersecurity, offering a graphic and consecutive structure that allows a better understanding of what a cyberattack is and the risks it generates in the organisation.  
By applying the Cyberkill Chain, it is possible to analyse attack campaigns in order to see similarities and differences between the TTPs of different attackers and thus the presence of patterns that point to a specific malicious actor. Furthermore, by compartmentalisingactions, it is possible to observe, from a higher level, the possible targets towards which the ongoing actions are directed and to anticipate the possible success of an attack.  
It contemplates indicators of three typologies:  
* Atomic: indicators that cannot be broken down into smaller parts and retain their meaning in the context of an attack (IP, domains, etc.);
* Computational: derived from the data obtained in an incident (hash);
* Behavioural: collections of atomic and computational indicators (TTPs).  
Formally, following the mathematical representation proposed in the Diamond Model, given a step S, an event E can be represented as follows in the Cyberkill Chain model:  
\[\text{E}=((\text{S}_{1}),(\text{S}_{2}),(\text{S}_{3}),\dots(\text{S}_{n}))\]  
where n is the number of steps involved.  
The great popularity of this framework offers the possibility of finding a wide range of technical reports from different consultancies and CERT/CSIRTs that follow its methodology. In turn, its structure inspired the development of the Mitre model's tactics. However, it has a very static and inflexible structure, especially for attacks that go beyond intrusions, such as those executed by APT groups, which has caused it to become progressively outdated. Based on the APT approach, ref. [27] implemented a series of algorithms after the extraction, selection, and classification of features at each of the phases of the Cyberkill Chain.  
Figure 3: Cyberkill Chain [26].