Threat actor attribution is a crucial defense strategy for combating advanced
persistent threats (APTs). Cyber threat intelligence (CTI), which involves
analyzing multisource heterogeneous data from APTs, plays an important role in
APT actor attribution. The current attribution methods extract features from
different CTI perspectives and employ machine learning models to classify CTI
reports according to their threat actors. However, these methods usually
extract only one kind of feature and ignore heterogeneous information,
especially the attributes and relations of indicators of compromise (IOCs),
which form the core of CTI. To address these problems, we propose an APT actor
attribution method based on multimodal and multilevel feature fusion (APT-MMF).
First, we leverage a heterogeneous attributed graph to characterize APT reports
and their IOC information. Then, we extract and fuse multimodal features,
including attribute type features, natural language text features and
topological relationship features, to construct comprehensive node
representations. Furthermore, we design multilevel heterogeneous graph
attention networks to learn the deep hidden features of APT report nodes; these
networks integrate IOC type-level, metapath-based neighbor node-level, and
metapath semantic-level attention. Utilizing multisource threat intelligence,
we construct a heterogeneous attributed graph dataset for verification
purposes. The experimental results show that our method not only outperforms
the existing methods but also demonstrates its good interpretability for
attribution analysis tasks.

提出了一种基于多模式和多层次特征融合的高级持续性威胁行为者归因方法，该方法利用异构属性图来表征高级威胁报告及其威胁迹象的信息，并提取融合多模式特征以构建全面的节点表示，进而设计多层次的异构图注意力网络来学习高级威胁报告节点的深层隐藏特征，结果表明该方法在归因分析任务中不仅优于现有方法，而且具有良好的可解释性。