Fingerprint for Mobile-Sensor APT Detection Framework (FORMAP) Based on Tactics Techniques and Procedures (TTP) and MITRE

Advanced Persistent Threat (APT) is a targeted attack technique utilized by a sophisticated and expert adversary to preserve undetected access over an extended period to the exfiltration of important information. The APT attack has several attacks, such as social engineering techniques via spear phishing, SQL injection, malware, and watering hole. A smartphone contains many sensors and services, which are essential in supporting user activities that could comprise sensitive information. Therefore, a smartphone has become the primary goal of attackers to carry out Advanced Persistent Threat (APT) attacks. Many challenges occurred due to the vulnerability of smartphone sensors and services, security framework, and ineffectiveness of methods for detecting APT. Although there are many APT solutions designed and implemented, they fail to provide a comprehensive solution. The reason is due to the lack of APT attack profiles or fingerprinting. Fingerprinting of attacks follows a step by steps of TTP. As a result, this paper proposes an FORMAP framework based on the correlation between MITRE Framework and the attack tree. This framework contributes in improving the security awareness that supports detecting an APT attack on smartphones.