# Learning the Associations of MITRE ATT&CK Adversarial Techniques

arXiv: https://arxiv.org/abs/2005.01654 · HTML: https://mlsanity.com/paper/2005.01654/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Apr 2020.

## Built on by (most cited first, 6 of 6)

- [Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild](https://mlsanity.com/paper/2307.10214/) (2023)
- [AttackQA: Development and Adoption of a Dataset for Assisting Cybersecurity Operations using Fine-tuned and Open-Source LLMs](https://mlsanity.com/paper/2411.01073/) (2024)
- [Mining Temporal Attack Patterns from Cyberthreat Intelligence Reports](https://mlsanity.com/paper/2401.01883/) (2024)
- [NUANCE: Near Ultrasound Attack On Networked Communication Environments](https://mlsanity.com/paper/2305.10358/) (2023)
- [Security Decisions for Cyber-Physical Systems based on Solving Critical Node Problems with Vulnerable Nodes](https://mlsanity.com/paper/2406.10287/) (2024)
- [A TTP by TTP Approach: Precise Malware Detection via Malicious TTP Recognition](https://mlsanity.com/paper/2609.06579/) (2026)

## Abstract (arXiv)

The MITRE ATT&CK Framework provides a rich and actionable repository of adversarial tactics, techniques, and procedures (TTP). However, this information would be highly useful for attack diagnosis (i.e., forensics) and mitigation (i.e., intrusion response) if we can reliably construct technique associations that will enable predicting unobserved attack techniques based on observed ones. In this paper, we present our statistical machine learning analysis on APT and Software attack data reported by MITRE ATT&CK to infer the technique clustering that represents the significant correlation that can be used for technique prediction. Due to the complex multidimensional relationships between techniques, many of the traditional clustering methods could not obtain usable associations. Our approach, using hierarchical clustering for inferring attack technique associations with 95% confidence, provides statistically significant and explainable technique correlations. Our analysis discovers 98 different technique associations (i.e., clusters) for both APT and Software attacks. Our evaluation results show that 78% of the techniques associated by our algorithm exhibit significant mutual information that indicates reasonably high predictability.