A Markov Multi-Phase Transferable Belief Model: an Application for Predicting Data Exfiltration Apts
Georgios Ioannou, Panos Louvieris, Natalie Clewley, Gavin Powell · viXra · 2013
eXfiltration Advanced Persistent Threats (XAPTs) increasingly account for incidents concerned with intelligence information gathering by malicious adversaries. This research exploits the multi-phase nature of an XAPT, mapping its phases into a cyber attack kill chain. A novel Markov Multi-Phase Transferable Belief Model (MM-TBM) is proposed and demonstrated for fusing incoming evidence from a variety of sources which takes into account conflicting information. The MM-TBM algorithm predicts a cyber attacker's actions against a computer network and provides a visual representation of their footsteps.