NetworkTrace: Probabilistic Relevant Pattern Recognition Approach to Attribution Trace Analysis

Network attack prevention is a critical research area of information security. Network attacks would become choked if attribution techniques are capable of tracing back to the attacker after the hacking event. Therefore, attributing these attacks to a person or organization turns into one of the important tasks when analysts attempt to profile the attacker behind attack traces. To facilitate this process, we research on the connections among attribution traces and propose methods based on probabilistic relevance. First, we present a two-layer NetworkTrace frame, then based on relevance patterns, we propose the existence probability of concerned subjects. At last, we quantify the connection relevance between subjects through a Ref algorithm. By means of analyzing the attribution traces extracted from APT1 report, we illustrate the effectiveness of the existence probability algorithm. Then, we demonstrate Ref's effectiveness in quantifying the relevancies between organization and its affinitive partners by analyzing the relevancies and draw relevance matrix between APT1 inodes. The results show the proposed NetworkTrace facilitates the evaluation of the plausibility relevance between different traceable subjects.