Lion Cipher Lab
Cluster intrusion sets by ATT&CK TTP overlap — and reason about attribution (from scratch)
- Threat Intel Analyst
- Advanced
- ~80 min
- Free · no account required
Why it matters
When a threat-intel team stares at fifty intrusions, the first useful question is not 'who did this' but 'which of these belong together.' MITRE ATT&CK itself defines Groups as 'activity clusters that are tracked by a common name' — that word, CLUSTERS, is doing quiet, load-bearing work, and this lab is about respecting it. Grouping intrusions by the techniques they share (their TTPs) is genuinely powerful triage: it spots campaigns, links a fresh incident to prior ones, and tells you where to spend scarce analyst hours. But the naive version fails in a specific, dangerous way. Almost every…
What you'll learn
- representing an intrusion as a SET of MITRE ATT&CK technique IDs (TTPs) and building a self-contained, seeded dataset with a KNOWN ground truth (three real activity clusters plus noise that shares only ubiquitous techniques)
- computing a pairwise Jaccard similarity matrix over raw TTP sets and implementing average-linkage agglomerative clustering FROM SCRATCH in pure-Python stdlib (no sklearn)
- scoring a clustering against ground truth with an adjusted Rand index you implement by hand, and reading the naive failure: common techniques (T1059/T1071.001/T1105) create spurious similarity that merges unrelated intrusions (ARI 0.573)
- fixing it with discriminating-power weighting: an IDF-style weight (rare technique = high weight) turns raw Jaccard into a weighted Jaccard, cross-cluster similarity collapses, and the true groups snap out (ARI 0.961)
- the attribution judgment: a cluster groups ACTIVITY, not a human actor — shared TTPs can come from shared open-source tooling, a shared RaaS affiliate program, a copied playbook, or a deliberate FALSE FLAG
- expressing findings in structured-analytic confidence/likelihood language and tying TTP clustering to the sibling techniques (Analysis of Competing Hypotheses, the Diamond Model) instead of leaping to a named group
- distinguishing BEHAVIORAL clustering (TTP overlap) from BINARY clustering (fuzzy hashing of files), and knowing when TTP clustering earns its keep (triage, campaign relationships, prioritization) versus its hard limits (base rate of common techniques, small-sample instability)
Steps in this lab
- What TTP clustering is — and why raw overlap lies
- Generate a self-contained, seeded dataset with a known ground truth
- Round 1 — naive Jaccard + agglomerative clustering, from scratch
- Round 2 — down-weight the techniques everyone uses (IDF weighting)
- The attribution half — a cluster groups ACTIVITY, not an actor
- The judgment — when TTP clustering earns its keep, and its hard limits