Abstract

Cyber threats are evolving where threat actors diversify their attack strategies and patterns, which incorporate refined and new tools to conceal their real identity and fingerprints. The rapidly evolving nature of Advanced Persistent Threats (APTs) outpaces current reactive security solutions, which are not prepared to anticipate variants of future attacks. In this thesis, we introduce APTMORPH+, a proactive threat hunting solution that anticipates variants of emerging APT campaigns. APTMORPH+ leverages a Generative Adversarial Network (GAN) model empowered with Reinforcement Learning (RL) to generate those variant campaigns. APTMORPH+ is trained on temporal security context data across 2019-2025 from the MITRE ATT&CK knowledge base to learn how to generate variant campaigns using security contexts. The model consists of both an Adversarial and Reinforcement Learning loops, which incorporate (i) a Technique Generator to anticipate the techniques of an APT campaign, (ii) a Technique Discriminator to filter out the least probable techniques to occur, (iii) a Security Context Evaluator to evaluate the semantic meaning of the variant campaigns, (iv) a Sequence Assembler to assemble the final sequences of campaigns, and (v) a Campaign Classifier, which identifies the aligned variant campaigns based on semantic features. To validate APTMORPH+, we performed time-series splitting of the MITRE data in comparison with the campaigns pre- and post- a selected year. APTMORPH+ was able to anticipate emerging variant APT campaigns while maintaining a high behavioral similarity score.