Traditional Network Intrusion Detection Systems (NIDS) often generate large volumes of alerts with redundancies and false positives, incapable of correlating detected attack actions. This adds difficulty for security analysts to construct a comprehensive understanding of multi-step attacks. To address these limitations, we present a novel MITRE-based Multi-step Attack Scenario Construction (M2ASK) algorithm that enhances cyber threat intelligence (CTI) by integrating MITRE ATT&CK tactic and technique mapping, facilitating the interpretation of multi-step attacks and informing response strategies. Our approach processes alert data from NIDSs, transforming it into a network communication graph. Graph-based correlation techniques are employed, combined with MITRE ATT&CK and Cyber Kill Chain stage profiling to construct comprehensive network attack scenarios. Our key contributions include: (1) the development of a Cyber Kill Chain based model for constructing attack scenarios; (2) the alert correlation approach based on MITRE ATT&CK tagging of attack actions.

As Information Technology (IT) infrastructures have become increasingly complex to secure against accelerating cyber threats, current threat detection approaches have been largely silos in nature; security analysts in the environment are typically bombarded with large volume of security alerts that often cause severe fatigues and the possibility of judgement errors. This problem is further exacerbated by the number of false-positives that analysts may waste valuable time and resources pursuing. In this paper, we present how intuitive graph-based machine learning can be used to address the problem of alert fatigue and prioritize risky alerts to assist security analysts. The rationale and workflow of the proposed Graph Analysis (GA) algorithm is discussed in detail, with its effectiveness demonstrated by simulated experiments.