analyzing-campaign-attribution-evidence

Files (8)

• LICENSE
• SKILL.md
• template.md · assets/
• api-reference.md · references/
• standards.md · references/
• workflows.md · references/
• agent.py · scripts/
• process.py · scripts/

SKILL.md (first lines)

# 分析攻击活动溯源归因证据

## 概述

攻击活动溯源归因（Attribution）分析涉及系统性地评估证据，以确定哪个威胁行为者（Threat Actor）或组织对某次网络行动负责。本技能涵盖使用 Diamond Model 和 ACH（竞争假设分析）收集并加权溯源指标、分析基础设施重叠、TTP 一致性、恶意软件代码相似性、操作时序模式和语言痕迹，以构建置信度加权的归因评估报告。

## 前置条件

- Python 3.9+，安装 `attackcti`、`stix2`、`networkx` 库
- 访问威胁情报平台（MISP、OpenCTI）
- 了解 Diamond Model 入侵分析框架
- 熟悉 MITRE ATT&CK 威胁组织画像
- 掌握恶意软件分析和基础设施追踪技术

## 核心概念

### 溯源证据类别
1. **基础设施重叠**：共享 C2 服务器、域名、IP 范围、托管服务商
2. **TTP 一致性**：跨攻击活动中匹配的 ATT&CK 技术和子技术
3. **恶意软件代码相似性**：共享代码库、编译器、PDB 路径、加密例程
4. **操作模式**：时序（工作时间、时区）、目标模式、操作节奏
5. **语言痕迹**：特定语言的嵌入字符串、变量名、错误消息
6. **受害者学**：目标行业、地理位置和组织画像一致性

### 置信度级别
- **高置信度**：多个独立证据类别聚焦于同一行为者
- **中置信度**：若干证据类别匹配，但存在一定模糊性
- **低置信度**：证据有限，可能存在伪旗或共享工具

### 竞争假设分析（ACH）
一种结构化分析方法，针对多个竞争假设评估证据。每条证据针对每个假设被评分为一致、不一致或中性。不一致证据最少的假设为优先假设。

## 实践步骤

### 步骤 1：收集溯源证据

```python
from stix2 import MemoryStore, Filter
from collections import defaultdict

class AttributionAnalyzer:
    def __init__(self):
        self.evidence = []
        self.hypotheses = {}

    def add_evidence(self, category, description, value, confidence):
        self.evidence.append({
            "category": category,
            "description": description,
            "value": value,
            "confidence": confidence,
            "timestamp": None,
        })

    def add_hypothesis(self, actor_name, actor_id=""):
        self.hypotheses[actor_name] = {
            "actor_id": actor_id,
            "consistent_evidence": [],
            "inconsistent_evidence": [],
            "neutral_evidence": [],
            "score": 0,
        }

    def evaluate_evidence(self, evidence_idx, actor_name, assessment):
        """评估证据与假设的关系：一致/不一致/中性。"""
        if assessment == "consistent":
            self.hypotheses[actor_name]["consistent_evidence"].append(evidence_idx)
            self.hypotheses[actor_name]["score"] += self.evidence[evidence_idx]["confidence"]
        elif assessment == "inconsistent":
            self.hypotheses[actor_name]["inconsistent_evidence"].append(evidence_idx)
            self.hypotheses[actor_name]["score"] -= self.evidence[evidence_idx]["confidence"] * 2
        else:
            self.hypotheses[actor_name]["neutral_evidence"].append(evidence_idx)

    def rank_hypotheses(self):
        """按溯源分数对假设进行排序。"""
        ranked = sorted(
            self.hypotheses.items(),
            key=lambda x: x[1]["score"],
            reverse=True,
        )
        return [
            {
                "actor": name,
                "score": data["score"],
                "consistent": len(data["consistent_evidence"]),
                "inconsistent": len(data["inconsistent_evidence"]),
                "confidence": self._score_to_confidence(data["score"]),
            }
            for name, data in ranked
        ]

    def _score_to_confidence(self, score):
        if score >= 80:
            return "HIGH"
        elif score >= 40:
            return "MODERATE"
        else:
            return "LOW"
```

### 步骤 2：基础设施重叠分析

```python
def analyze_infrastructure_overlap(campaign_a_infra, campaign_b_infra):
    """比较两个攻击活动的基础设施以进行溯源。"""
    overlap = {
        "shared_ips": set(campaign_a_infra.get("ips", [])).intersection(
            campaign_b_infra.get("ips", [])
        ),
        "shared_domains": set(campaign_a_infra.get("domains", [])).intersection(
            campaign_b_infra.get("domains", [])
        ),
        "shared_asns": set(campaign_a_infra.get("asns", [])).intersection(
            campaign_b_infra.get("asns", [])
        ),
        "shared_registrars": set(campaign_a_infra.get("registrars", [])).intersection(
            campaign_b_infra.get("registrars", [])
        ),
    }

From killvxk/cybersecurity-skills-zh, Apache-2.0.

More from killvxk/cybersecurity-skills-zh