Exploration of Behavior-Based Advanced Persistent Threat (APT) Detection: A Systematic Analysis based on Open CTI, MITRE ATT&CK, and Machine Learning

https://doi.org/10.5281/zenodo.19240257

Abstract

Advanced Persistent Threats (APTs) pose a big challenge to today’s Computing systems. They use long-term, stealthy, and behaviour-driven attack methods and avoid reusable malware and fixed setups. Traditional detection methods using Indicators of Compromise (IOCs) like IP addresses and file hashes are becoming less effective. This is due to quick changes in infrastructure and the common use of legitimate system tools. As a result, recent research has shifted toward behavior-based and actor-centric detection models. This article focuses on how OpenCTI, MITRE ATT&CK, and machine learning work together. They enhance the detection and attribution of APTs. Stealth Falcon (MITRE ATT&CK) serves as a key case study. A Systematic (SLR) examined recent studies that focused on CTI platforms, behaviour analytics linked to ATT&CK, knowledge graph models, machine learning detection, and simulation-based evaluation. The findings show that OpenCTI’s knowledge graph connects actors, campaigns, infrastructure, and TTPs over time. Meanwhile, MITRE ATT&CK offers a standard framework to map adversary actions. Using ATT&CK-aligned TTP sequences in machine-learning models, like Random Forest and XGBoost, improves detection accuracy. It also lowers false positives when compared to IOC-based methods. These models support actor-centric attribution. They find stable behavioural fingerprints. This helps track Stealth Falcon in different campaigns. The review also points out major gaps in current research. These include limited real-world testing, scalability issues, and poor integration with SOC tools. The study shows that using OpenCTI, MITRE ATT&CK, and machine learning creates a strong base for detecting APTs. This approach emphasises behaviour and actors and has a significant shift towards traditional, indicator-driven security models.