Towards a definition of cyberspace tactics, techniques and procedures

Cybersecurity professionals often speak of tactics, techniques and procedures (TTPs) when describing the activities of threat actors, yet these terms are not as well defined in cybersecurity as in military doctrine. Systems that use artificial intelligence (AI) and machine learning (ML) to address cybersecurity problems could better determine adversarial intent and future actions by connecting sequences of actions to threat actor intent. In this paper, we define TTPs in relation to cybersecurity and present a model of TTPs for cyberspace operations that is useful to both humans and synthetic agents. We then describe how these can be applied to real-world cyberspace operations, using advanced persistent threat (APT) 28's Pawn Storm campaign as an exemplar. Finally, we show how we've approached the development of ML algorithms to provide predictive analytics based on large security datasets.