METHOD FOR DETECTING PATTERNS IN THE EVOLUTION OF CYBERATTACK TECHNIQUES BASED ON TOPOLOGICAL DATA ANALYSIS
Vitalii Fesokha, Ihor Subach · Cybersecurity Education Science Technique · 2025
In the context of improving the cyber resilience of special information and communication systems (ICS), the task of studying the evolution of cyber attacks, caused by their increasing dynamism and unpredictability, is considered. It is shown that existing approaches (temporal graphs, assessment of technique prevalence, chain analysis, change detection, comparison of taxonomy versions) mostly capture statistical and sequential aspects and do not reveal hidden invariants and structural relationships between cyberattack techniques. A method based on topological data analysis is proposed, which models techniques in a common interpreted space of structural, graph and semantic features (without neural network compression) and uses weighted cosine distance to construct Vietoris–Rips simplicial complexes and dynamic persistent diagrams with consistent cross-version comparison of homology classes. Thresholds are standardized and characteristics are unified for inter-version comparability; criteria and parameters are fixed, ensuring reproducibility of results and independence of conclusions from the choice of scale. The method identifies two types of patterns: topological trends (changes in connectivity, fragmentation, and cyclicality of the technique space over time) and trajectory invariants—chains of homology classes that are tracked seamlessly across versions using formal coverage and persistence criteria. A demonstration analysis of the MITRE ATT&CK taxonomy (versions 14.1–17.0) revealed a pattern of change with significant restructuring in major releases and a tendency towards fragmentation of the technique space. Integral invariants are interpreted as stable boundaries/contours between clusters of techniques and can be used to predict changes and plan analytics updates, implementing the principle of cyber resilience evolution.