Characterizing Advanced Persistent Threats with Cyber Attack Flow Metrics

Authors

• Tyler Miller, Pikes Peak State CollegeFollow
• Caleb Chang, University of Colorado, Colorado SpringsFollow
• Shouhuai Xu, University of Colorado, Colorado Springs (UCCS)Follow

Abstract

Cyber attack campaigns vary not only in scale but in structure, yet conventional characterizations often reduce them to a single dimension such as technique count or impact severity. In this paper we extend the concept of cyber attack flows by defining three new metrics, novelty, technique complexity and flow complexity. Then we characterize the attack flows of three advanced persistent threat campaigns using these metrics and draw insights regarding their capabilities. Our findings include that low novelty does not equate to low attack capabilities and that exploitation of an internet-facing appliance is a common initial attack vector.

DOI

https://doi.org/10.5038/2378-0789.9.1.1155

Recommended Citation

Miller, Tyler; Chang, Caleb; and Xu, Shouhuai (2026) "Characterizing Advanced Persistent Threats with Cyber Attack Flow Metrics," Military Cyber Affairs: Vol. 9 : Iss. 1 , Article 6.
https://doi.org/10.5038/2378-0789.9.1.1155
Available at: https://digitalcommons.usf.edu/mca/vol9/iss1/6