MITRE ATT&CK Applications in Cybersecurity and The Way Forward
Not on the map. Why?
Abstract (arXiv)
The MITRE ATT&CK framework is a widely adopted tool for enhancing cybersecurity, supporting threat intelligence, incident response, attack modeling, and vulnerability prioritization. This paper synthesizes research on its application across these domains by analyzing 417 peer-reviewed publications. We identify commonly used adversarial tactics, techniques, and procedures (TTPs) and examine the integration of natural language processing (NLP) and machine learning (ML) with ATT&CK to improve threat detection and response. Additionally, we explore the interoperability of ATT&CK with other frameworks, such as the Cyber Kill Chain, NIST guidelines, and STRIDE, highlighting its versatility. The paper further evaluates the framework from multiple perspectives, including its effectiveness, validation methods, and sector-specific challenges, particularly in industrial control systems (ICS) and healthcare. We conclude by discussing current limitations and proposing future research directions to enhance the applicability of ATT&CK in dynamic cybersecurity environments.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 15 of its 263 references that are in the map. First posted on arXiv 15 Feb 2025.
Builds on
15 of 263 references.
References · 15
- 2021AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reportscited by 31
- 2020Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reportscited by 17
- 2023STIXnet: A Novel and Modular Solution for Extracting All STIX Objects in CTI Reportscited by 10
- 2022Investigating co-occurrences of MITRE ATT&CK Techniquescited by 4
- 2024Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognitioncited by 4
- 2021Threat Actor Type Inference and Characterization within Cyber Threat Intelligencecited by 3
- 2023Laccolith: Hypervisor-Based Adversary Emulation with Anti-Detectioncited by 2
- 2024The Pulse of Fileless Cryptojacking Attacks: Malicious PowerShell Scriptscited by 2
- 2020Big Fish, Little Fish, Critical Infrastructure: An Analysis of Phineas Fisher and the 'Hacktivist' Threat to Critical Infrastructurecited by 1
- 2021RANK: AI-assisted End-to-End Architecture for Detecting Persistent Attacks in Enterprise Networkscited by 1
- 2021Security Assessment Rating Framework for Enterprises using MITRE ATT&CK Matrixcited by 1
- 2021Towards Dynamic Threat Modelling in 5G Core Networks Based on MITRE ATT&CKcited by 1
3 more
- 2022Principled Data-Driven Decision Support for Cyber-Forensic Investigationscited by 1
- 2023An Approach to Abstract Multi-stage Cyberattack Data Generation for ML-Based IDS in Smart Gridscited by 1
- 2024Enhancing cybersecurity defenses: a multicriteria decision-making approach to MITRE ATT&CK mitigation strategycited by 1
Built on by
Citing papers per year: 2026: 2.
2 papers.