ADAPT it! Automating APT Campaign and Group Attribution by Leveraging and Linking Heterogeneous Files

ADAPT is a machine-learning framework for automated attribution of Advanced Persistent Threats at two levels: campaign-level clustering of related samples and group-level correlation across heterogeneous artifacts (executables and documents). The authors assemble and relabel a 6,134-sample APT dataset (92 groups) and a 230-sample campaign reference set, extract executable-, document-, and linking-features (patterns and infrastructure), and use autoencoder-assisted agglomerative clustering to produce high-precision campaign and group attributions, validated with quantitative metrics and qualitative case studies.