Attack Flow

Beyond atomic behaviors

MITRE's Desiree Beck, Verizon's Gabriel Bassett, and Fujitsu's Ryu Masuka present Attack Flow, a Center for Threat-Informed Defense project. They argue CTI and incident response suffer when analysts treat isolated indicators as noise instead of recognizing related steps as a meaningful campaign sequence.

What an attack flow is

An attack flow models coordinated adversary behavior as structured objects and relationships rather than disconnected atomic events. Poor sequence understanding leads to weaker containment and remediation when campaigns unfold across multiple stages.

Graph representation with RDF

The data model builds on RDF triples—subject, predicate, object—mapped to source, relationship, and destination. This graph foundation supports reasoning across linked techniques, assets, and actions, with tooling aligned to semantic web standards for sharing and analysis at scale.