Identification of Potential Threats in the Critical Path for Defense Operations by Cross Reference Features Clustering - Horta, Antonio; Marinho, Renato; Holanda, Raimir (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2023: Anais do XXIII Simpósio Brasileiro de Segurança da Informação e de Sistemas ComputacionaisDO - 10.5753/sbseg.2023.232598, 2023)
Cyber attacks are a threat to the security of the most diverse types of organizations. To mitigate the risk of suffering successful attacks, organizations use different types of assessments. The research problem addressed in this study is to present, among the behaviors of known threats, those that are similar to the assessment campaign carried out and consequently represent greater risk when attempting attacks using the more exploitable critical path. The purpose of this research is to present a method for identifying the critical path of the threat and the similarity factor by Cross Reference Features (CRF) method to identify the opponents most similar to the procedures used in the assessment campaign carried out. The CRF was used as a baseline for comparison between 2 unsupervised learning algorithms in the threat clustering task. For essays that considered only groups as threats, K-means outperformed the Hierarchical Agglomerative Clustering by 2.4 percentage points, while in the essay with all threats, Hierarchical Agglomerative Clustering surpassed K-means by 2.3%.