Unmasking APTs: An Automated Approach for Real-World Threat Attribution
summary
An automated system called ADAPT clusters heterogeneous malware artifacts (22+ file types) collected from AlienVault and downloaded from VirusTotal, with an initial 6,545-sample corpus relabeled down to 6,134 samples and 92 unified groups. Static features come from floss and YARA, plus exiftool, olevba and lief; features are vectorized with sentence transformers and clustered with agglomerative hierarchical clustering. Results show ~91% precision for executable campaign clustering, 98% for documents and 84% for group-level precision.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:51Advanced Persistent Threats
- 4:20APT attribution challenges
- 8:12ADAPT attribution system
- 9:57ADAPT system design
- 11:45Dataset collection
- 13:53Dataset cleaning
- 16:21Feature extraction
- 18:47Group attribution
- 20:31Feature transformation
- 23:01Modeling and clustering approach
- 24:50Evaluation with MITRE data
- 27:17Case study APT29 malware
- 30:47Next steps ADAPT 2.0
- 32:33Key highlights
- 34:00Q&A
related talks
23mData Driven APT Attribution and AI/ML Research
30mTracking Threat Actors Using Images: A Hunting & Analysis Approach
17mMapping the Connections Inside Russia’s APT Ecosystem
22mAPT Attribution and DNS Profiling
44mApplied Machine Learning for Data Exfil and Other Fun Topics
36mNinja Correlation of APT Binaries
41mAndroid malware forensics
41mHow AI Is Changing the Malware Landscape