Attack Group Analysis and Identification based on Heterogeneous Graph

There has been a significant increase in incidents caused by malicious attack groups. The techniques employed by these groups are evolving daily, becoming more complex and sophisticated. Their attacks leverage multiple vulnerabilities to evade our detection networks and have complex operational behaviors, making analysis extremely challenging. Therefore, security personnel require a response system that can analyze complex threat landscape easily and detect threats precisely. We describe the complex threat landscape considering heterogeneous Indicators of Compromise(IOCs) and predict future scenarios. This paper presents cases of searching for similar homogenous IOCs and predicting the relationships between heterogeneous IOCs. Through our work, analysts can effortlessly gain knowledge about the threat landscape. Additionally, we design an AI(Artificial Intelligence) model that considers the interdependent relationships between IOCs to identify attack groups. Our approach has shown better performance than traditional AI classification methods and graph-based classification methods.