linking abstract attack techniques to concrete defensive actions sour…

[ellipse2v]

…ced directly from official MITRE data.

• Automated Enrichment Pipeline: The framework follows a systematic, multi-step process to map threats:
  1. STRIDE to CAPEC: For a given threat, its STRIDE category (e.g., "Tampering") is used to look up a list of associated CAPEC patterns from the stride_to_capec.json data.
  2. CAPEC to ATT&CK: Each of a threat's associated CAPEC IDs is then used as a key in the capec_to_mitre_map (built from the CAPEC_VIEW_ATT&CK_Related_Patterns.csv file) to find a list of corresponding MITRE ATT&CK technique IDs.
  3. Description-Based Refinement (Secondary Mapping): In addition to the primary STRIDE-based mapping, the system also uses a set of regex patterns to find keywords directly within the threat's description (e.g., mapping the term "sql injection" directly to T1190). This acts as a secondary mechanism to catch highly specific threats or variations not covered by the broader STRIDE-to-CAPEC mapping.
  4. Aggregation and Uniqueness: The techniques identified from both the primary (STRIDE-based) and secondary (description-based) mappings are combined, and duplicates are removed to produce a final, unique list of enriched MITRE ATT&CK techniques for the threat.
  5. D3FEND Countermeasures: Finally, the identified ATT&CK techniques are cross-referenced with the D3FEND data to attach relevant countermeasures and mitigations.