This must be a common problem in intel spaces where you are presenting evidence to support a hypothesis but you don’t have absolute definitive evidence, and so you need to assert some confidence level other than “certain”. Especially in attribution, I would imagine.
So how do you calculate confidence? Is there some sort of standardization on this practice?
“Quantify” is tricky, but we actually touched on this in our own posting guidelines. Big fan of the Admiralty Code for assessing intelligence:
For individual pieces of information or sources, you have the Admiralty Scale. However, it doesn’t really apply when talking about the confidence level of an analysis or conclusion
I can mostly speak about threat intel where we frequently use confidence levels for attribution, and there’s not really a standard. The low/medium/high scale is commonly used, but it’s squishy and, unfortunately, those levels tend to mean different things for different organizations.
When I was working to establish internal guidelines for attribution at work, I looked at a lot of definitions to come up with a standard for how we use the confidence levels. I’ll include the relevant part below, but I always tell people to show their work when talking about confidence levels.
The confidence level is like your executive summary, it’s a general statement for people who don’t want to dig into your analysis. You should explain how you came to the conclusion and what data you used. That way, people who do want to go into the details can properly assess what you mean by low/medium/high.
Generally, if overlaps are found in only one attribution aspect, the confidence level should not be higher than medium since there is not enough corroboration to warrant a high confidence. On the other hand, if strong overlaps are found in every attribution aspect, the confidence level should most likely be set at high.
The kind of overlapping indicators should also be considered when defining a confidence level as some indicators have more weight than others (indicators that are harder to tamper with or less likely to appear by chance).
- A high confidence attribution means that your attribution hypothesis is the best among every other competing hypothesis. As mentioned above, the more indicators in every attribution aspect, the higher the chance to exclude irrelevant or weaker hypothesis. If you have fairly unique indicators exclusive to a threat actor, (and ideally, for several attribution aspects), your attribution can be considered high confidence.
- A medium confidence attribution means that your attribution hypothesis is among the best remaining hypothesis but some of the competing hypothesis cannot be fully excluded. This case occurs when your hypothesis is supported by strong indicators in at least one attribution aspect, but other indicators point to competing theories or simply don’t match
- A low confidence attribution means that your attribution hypothesis is still competing with multiple others hypothesis. This case occur when you have very few matching indicators, or ones that are not very unique or exclusive to the threat actor you are attributing to. Your attribution cannot exclude attribution to another or a new group, but the one you’re making is the most likely based on the data.
I like this a lot. Thank you for sharing.
It does beg a question one layer deeper though - how are you defining your attribution hypothesis and other competing hypothesis?
Regarding attribution, I wouldn’t sweat it too much:
But if you mean behavioral clustering, you should absolutely be able to fill in the Diamond Model with sufficient evidence to justify the cluster.
Attribution is just one scope of confidence measuring.
What I’m looking for is a way to quantify confidence in a hypothesis-driven case analysis. In particular I am looking for a way to harden an LLM-driven IR investigation because I absolutely do not trust an LLM to just give me a vibe-answer for “how confident are you?” and instead I would like to abstract that to some sort of deterministic measure.
I think the the Admiralty scale is a great start and not too dissimilar to what I’ve already thought about, but doesn’t 1:1 apply to an IR investigation.
I think it is pretty easy to start with the hypothesis+question driven approach:
If an EDR alert comes in saying a suspicious scheduled task was created, there are a handful of things you might want to investigate before coming to a conclusion:
Then each of those questions will be taken down an investigation path where additional questions might be asked but at the end, you can answer the question and assert “benign” or “malicious” with some evidence that supports that claim.
Where the admiralty scale here doesn’t quite match up is I’m not sure how relevant “reliability” is as you’re looking directly at log entries and unless you have a suspicion of tampering you can assert a relatively high level of reliable. “Credibility” is important and I think having multiple log sources/entries that agree with an assertion is worth measuring.
I would like to understand the hypothesis generation a little bit better though because we can imagine dozens of hypothesis being created for any single bit of evidence but which ones are worth creating in order build the competition of best hypothesis wins?
This is not a complete answer, but if we’re looking for a number, I think you have it embedded there somewhat in the way you’ve done the analysis so far. The number of correlating suspicious signals increases the likelihood of malicious activity. This is exactly how EDR heuristics work, albeit noisily. And then for each type of signal, you could weight them differently based on how you assess the strength of the signal.
This is a great conversation though. There’s obviously no standard and no right answer, so sharing wisdom is exactly what we want to do.