GroupTracer: Automatic Attacker TTP Profile Extraction and Group Cluster in Internet of Things

Figure 2

The process of generating the TTP profile. GroupTracer cuts payload into commands, maps these commands to the ATT&CK framework, and then abstracts the structure of the commands for a second mapping to techniques and tactics. The product of the first mapping and the second mapping constitutes the TTP profiles.