# APT-MMF: An advanced persistent threat actor attribution method based on multimodal and multilevel feature fusion

arXiv: https://arxiv.org/abs/2402.12743 · HTML: https://mlsanity.com/paper/2402.12743/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 63 references that are in the map.
- First posted on arXiv 20 Feb 2024.

## Builds on (most cited first, 12 of 12)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Semi-Supervised Classification with Graph Convolutional Networks](https://mlsanity.com/paper/1609.02907/) (2016)
- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [node2vec: Scalable Feature Learning for Networks](https://mlsanity.com/paper/1607.00653/) (2016)
- [DeepWalk: Online Learning of Social Representations](https://mlsanity.com/paper/1403.6652/) (2014)
- [Heterogeneous Graph Attention Network](https://mlsanity.com/paper/1903.07293/) (2019)
- [AVClass2: Massive Malware Tag Extraction from AV Labels](https://mlsanity.com/paper/2006.10615/) (2020)
- [Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence](https://mlsanity.com/paper/2103.03530/) (2021)
- [DeepAPT: Nation-State APT Attribution Using End-to-End Deep Neural Networks](https://mlsanity.com/paper/1711.09666/) (2017)
- [ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks](https://mlsanity.com/paper/1905.12590/) (2019)
- [An Argumentation-Based Reasoner to Assist Digital Investigation and Attribution of Cyber-Attacks](https://mlsanity.com/paper/1904.13173/) (2019)
- [Argumentation Models for Cyber Attribution](https://mlsanity.com/paper/1607.02171/) (2016)

## Built on by (most cited first, 1 of 1)

- [Advanced Persistent Threats (APT) Attribution Using Deep Reinforcement Learning](https://mlsanity.com/paper/2410.11463/) (2024)

## Abstract (arXiv)

Threat actor attribution is a crucial defense strategy for combating advanced persistent threats (APTs). Cyber threat intelligence (CTI), which involves analyzing multisource heterogeneous data from APTs, plays an important role in APT actor attribution. The current attribution methods extract features from different CTI perspectives and employ machine learning models to classify CTI reports according to their threat actors. However, these methods usually extract only one kind of feature and ignore heterogeneous information, especially the attributes and relations of indicators of compromise (IOCs), which form the core of CTI. To address these problems, we propose an APT actor attribution method based on multimodal and multilevel feature fusion (APT-MMF). First, we leverage a heterogeneous attributed graph to characterize APT reports and their IOC information. Then, we extract and fuse multimodal features, including attribute type features, natural language text features and topological relationship features, to construct comprehensive node representations. Furthermore, we design multilevel heterogeneous graph attention networks to learn the deep hidden features of APT report nodes; these networks integrate IOC type-level, metapath-based neighbor node-level, and metapath semantic-level attention. Utilizing multisource threat intelligence, we construct a heterogeneous attributed graph dataset for verification purposes. The experimental results show that our method not only outperforms the existing methods but also demonstrates its good interpretability for attribution analysis tasks.