Modeling APT using Knowledge Graphs

Advanced Persistent Threats (APT) are highly sophisticated attacks, perpetrated by well organized groups with the goal of infiltration, sabotage and data exfiltration. There are various online sources which detail the life cycle of various APTs (ex. MITRE ATT&CK ), but it is often not evident to go through all the collected information to get a clear idea how APTs function and the Indicators of Compromise (IoC) they leave behind.

Goal

The goal of this internship is to select a handful of APTs and model their behavior using Knowledge Graphs to have a robust graph-based representation of APT behavior. This can be later used for AI training in the scope of better APT identification and detection.

Expected outcome

source code of the Knowledge Graph on our GitLab server
1 blog post
1 poster
a project report documenting the research and implementation

Required skills

To start this project you should have some knowledge of:

Python programming language
git

Conditions

Applicant’s country of origin must be a member of EU or NATO

Tools and technologies

To achieve this project, you will use following tools and technologies:

Python programming language
use git to manage your source code
use GitLab to implement Continuous Implementation (CI)
framework for virtual network management (To be decided which)