GroupTracer: Automatic Attacker TTP Profile Extraction and Group Cluster in Internet of Things

Figure 3

GroupTracer generates the Abstract Syntax Tree for each payload to obtain command nodes and then extracts the abstract structure from command nodes.