Cyber-Attack Pattern Explorer (CAPE)

• CAPE is a collection of systems that extract, organize, simulate, and operationalize cyber-attack patterns from unstructured CTI for threat attribution and detection.
• One approach employs ML-driven, visually interactive analytics to mine CTI data and build a structured CTA-TTP matrix with high accuracy in actor attribution.
• Other implementations include modular BEC detection and CAPEv2 dynamic malware analysis, integrating explainability and real-time performance for cyber defenses.

Cyber-Attack Pattern Explorer (CAPE) is a name used in recent cybersecurity literature for several systems that emphasize cyber-attack patterns, tactics, techniques, procedures, and behavioral artifacts rather than only low-level indicators of compromise. In the cited literature, the name refers most directly to a machine learning–driven, visually interactive analytics tool for cyber threat attribution from unstructured Cyber Threat Intelligence (CTI) documents; it is also used for a modular and adaptive system for Business Email Compromise (BEC) detection, and for CAPEv2, an open-source dynamic malware analysis sandbox. Across these uses, CAPE denotes infrastructures for extracting, organizing, simulating, or operationalizing attack-pattern knowledge in support of attribution, detection, and analytic workflows (Kanwal et al., 15 Sep 2025, Brabec et al., 2023, Bosansky et al., 2022).

1. Terminological scope and principal instantiations

The term CAPE is not tied to a single architecture or application domain. In one line of work, CAPE is a visually interactive analytics tool that automates the discovery, clustering, and analysis of cyber-attack patterns from unstructured CTI documents, then allows analysts to interactively explore these patterns, attribute threats to actors, and visualize connections and trends. In another, CAPE is a comprehensive and efficient system for BEC detection that combines independent ML models and algorithms across text, images, metadata, and communication context. In a third, CAPEv2 is an open-source dynamic malware analysis sandbox, originating as a fork of Cuckoo Sandbox in 2019, with advanced monitoring and payload unpacking capabilities (Kanwal et al., 15 Sep 2025, Brabec et al., 2023, Bosansky et al., 2022).

CAPE usage	Primary objective	Distinctive characteristics
CTI-oriented CAPE	Threat attribution from unstructured CTI	Non-parametric topic detection, CTA-TTP matrix, interactive visualization
BEC-detection CAPE	Detect BEC and spear-phishing attacks	Modular detectors, logistic regression, Bayesian updating
CAPEv2	Dynamic malware analysis	Payload unpacking, YARA support, deep behavior logging

A common misconception is that CAPE denotes one standardized platform. The literature instead shows a shared emphasis on attack-pattern representation under the same acronym, but with markedly different data sources, analytic targets, and operational assumptions. This suggests that “CAPE” functions less as a fixed product category than as a recurring design orientation toward behavior-centric cyber analysis.

2. CTI analytics, non-parametric mining, and threat attribution

The CTI-oriented CAPE is organized into three main modules: a Data Repository, a CTI Analytics Module, and an Interactive Visualization Module. The Data Repository collects unstructured CTI documents from diverse sources such as security blogs, forums, news, vendors, and US-CERT, followed by format conversion, cleansing, and paragraph or sentence segmentation. The CTI Analytics Module performs frequent pattern mining, implements a non-parametric topic detection algorithm for extracting and clustering attack patterns, and assembles a structured dataset in the form of a CTA-TTP matrix linking cyber threat actors with their observed TTPs. The Interactive Visualization Module provides visualizations of attack pattern relationships, threat actors associated with patterns, and trends in attack pattern usage over time, enabling human-machine interaction for information discovery and attribution (Kanwal et al., 15 Sep 2025).

The core mining pipeline ranks keywords with an updated TF-IDF formulation,

$$T_t(wd, dc) = fr(dc, wd) \times idf(wd) \times ir(wd),$$

then represents features as a co-occurrence graph $G_R = (V_N, E_K)$, where $V_N$ are keywords and $E_K$ are edges weighted by word co-occurrence counts computed via FP-growth. Pattern detection is performed by a medoid-seeking clustering procedure with no fixed number of clusters. Density at a word $wd_j$ is estimated by

$$f(wd_j) = \sum_{i=1}^n m(wd_i)\cdot f_i(d(wd_i, wd_j)),$$

using a Gaussian kernel, and soft assignment permits a word to belong to several clusters:

$$m(H_k \mid wd_i) = \frac{1 - d(H_k, wd_i)}{\sum_k (1 - d(H_k, wd_i))}.$$

Document-level relevance to a pattern is then quantified by

$$m(H_k \mid dc) = \frac{\sum_{i=1}^n n(wd_i, dc)\cdot m(H_k \mid wd_i)\cdot \pi(wd_i)}{\sum_k \sum_{i=1}^n n(wd_i, dc)\cdot m(H_k \mid wd_i)\cdot \pi(wd_i)}.$$

The resulting CTA-TTP matrix contains 726 CTI instances, 50 cyber threat actors, and approximately 570 TTPs, with rows representing CTI instances and the target variable representing the threat actor. The reported machine learning baselines include Naïve Bayes, Random Forest, Deep Learning Neural Networks, Decision Trees, and K-Nearest Neighbors, with Naïve Bayes obtaining the highest overall performance: Accuracy 95.32%, Recall 95.56%, Precision 96.20%, F1-score 0.93, and false positive rate 2%. For CAPE’s information retrieval functions, average precision for document retrieval is 88.25% and average precision for actor information retrieval is 88.8%.

The visualization layer is web-based and includes a search bar, graph view, actor list, document list, and timeline view. These elements support iterative exploration rather than only batch classification. A plausible implication is that the system’s primary contribution lies not merely in actor labeling, but in coupling probabilistic pattern discovery with analyst-facing visual inspection.

3. Extraction, semantic linking, and graph representation of attack patterns

Several adjacent systems supply methods that can be incorporated into, or interpreted as complements to, CAPE-style attack-pattern exploration. LADDER automatically extracts text-based attack patterns from CTI reports at scale, characterizes attack patterns by capturing the phases of an attack in Android and enterprise networks, and systematically maps them to the MITRE ATT&CK pattern framework. EXTRACTOR automatically extracts concise attack behaviors from CTI reports as provenance graphs from unstructured text. BRON links MITRE ATT&CK, CAPEC, CWE, CVE, and CPE into an aggregate data graph that preserves all entries and relations of the sources while enabling bi-directional, relational path tracing. A hybrid NLP methodology estimates the relevance between CVE vulnerabilities and CAPEC attack patterns by combining semantic similarity with keyword analysis (Alam et al., 2022, Satvat et al., 2021, Hemberg et al., 2020, Bonomi et al., 13 Jan 2025).

LADDER’s pipeline includes automated crawling, preprocessing, manual annotation, named entity recognition, relationship extraction, triple generation, knowledge graph construction, and a TTPClassifier. The crawler uses a BFS strategy, collects more than 12,000 CTI reports, and is paired with a hand-annotated dataset of 36 malware with 140,447 tokens, 11,555 entities, and 5,499 relations. Relevant sentence extraction is treated as binary sentence classification; attack pattern phrase extraction uses BIO sequence tagging; mapping to MITRE ATT&CK is based on semantic similarity between phrase embeddings and ATT&CK technique titles and descriptions. If no mapping is sufficiently strong, LADDER can retain the raw phrase, allowing discovery of unknown or new attack TTPs. This directly operationalizes the proposition that attack patterns are more robust threat intelligence signals than IoCs.

EXTRACTOR converts CTI prose into provenance graphs through normalization, resolution, summarization, and graph generation. Its summarization stage uses a BERT classifier fine-tuned on 8,000 CTI sentences and a BiLSTM semantic role labeling stage to retain only observable system behaviors. Graphs are built as node-edge-node triples whose edges are canonical system calls such as write, open, exec, and connect, with typed nodes such as files, processes, registry keys, and sockets. Reported evaluation yields an average F1 of approximately 0.93 on public CTI and approximately 0.95 on DARPA reports, and the extracted graphs can be used by threat-hunting tools.

BRON contributes a different layer of organization. It models cybersecurity knowledge as a graph $G = (V, E)$, where nodes include CVE, CWE, CAPEC, ATT&CK Technique, and related entities, and edges encode mappings such as CVE $\leftrightarrow$ CWE and CAPEC $G_R = (V_N, E_K)$0 CWE. It supports traversal patterns such as CVE → CWE → CAPEC → ATT&CK Technique → ATT&CK Tactic and exposes “blind spots” where connectivity is absent. The paper explicitly notes that some prominent classes, including CWE-79/Cross-Site Scripting and CWE-787 (Out-of-bounds Write), can have missing connections to Tactics, Techniques, and CAPECs. For CAPE-like systems, this is significant because pattern exploration depends not only on mining quality but also on the completeness of the underlying knowledge graph.

The CVE-to-CAPEC relevance methodology adds a ranking layer. It uses CVE descriptions, multiple CAPEC textual attributes, SBERT and ATTACK-BERT embeddings, keyword and acronym analysis, and the aggregation

$G_R = (V_N, E_K)$1

On GT1, ATTACKBERT Hyb reaches Recall@1 and Recall@10 up to approximately 0.45 and approximately 0.81, with MRR 0.587 and Precision@1 0.445. On GT2, SBERT Hyb achieves Recall@1 = 0.346 and MRR = 0.585. This provides a concrete mechanism for turning vulnerability descriptions into ranked attack-pattern hypotheses.

4. Simulation platforms and datasets for attack-pattern exploration

A large part of CAPE-relevant research is dataset-oriented. The literature includes enterprise network simulation in Airbus CyberRange, railway ICS cyberattack simulation in a realistic cyber range, and large-scale dynamic malware execution in CAPEv2. These environments share a concern with realistic traffic, realistic host behavior, and labeled or reconstructable attack stages, but they operate at different layers: network traffic, IT/OT process manipulation, and malware execution logs (Dias et al., 2024, Yusof et al., 2 Jul 2025, Bosansky et al., 2022).

The Airbus CyberRange integration is designed for the creation of NID datasets with complex attack scenarios. It uses a realistic vulnerable network topology with three subnets: Service LAN (192.168.128.0/24), User LAN (192.168.132.0/24), and SOC LAN (192.168.134.0/24). Full-fledged operating systems run on virtualized hosts, benign hosts generate legitimate traffic such as web browsing, file transfers, NTP traffic, SSH, and pinging, and traffic is captured through SPAN ports to a monitoring PC. Three attack scenarios are implemented: Man-in-the-Middle, Denial-of-Service, and Brute-Force. The workflow is explicitly given as scenario definition, execution, SPANNING, traffic capture, and annotation and labeling. A representative flow feature vector for ML-based NID is written as <src_ip, dst_ip, src_port, dst_port, protocol, packet_count, byte_count, duration, flags, label>. The paper states that this supports generation of richly annotated NID datasets and analysis of attack pattern manifestations under realistic background conditions.

The railway ICS dataset contributes two end-to-end attack simulations, AS1 and AS2, on a digitally twinned railway ICS environment. AS1 includes insider facilitated malware delivery, internal phishing and propagation, command and control, SCP/SSH delivery of a False Control Injection module to PLC hosts, crafted Modbus TCP commands, and a critical operational incident involving emergency power cutoff and train crash. AS2 includes exploitation of a deserialization vulnerability in a public-facing railway web application, a pickle bomb web shell, credential theft, lateral movement, S7Comm-based False Data Injection on a SCADA workstation, and a simulated power failure affecting rail operations. Evidence types include file system images, memory images, network captures, system and application logs, and supplemental SSL keys and screen recordings. The dataset structure example reports AS1 with 19.63 GB file system, 7.00 GB memory image, and 2.13 GB network capture, and AS2 with 4.64 GB memory image, 966.77 MB network capture, and 352.92 KB system logs. The paper explicitly states that such data is ideal for transformation into structured attack pattern descriptions, including CAPE format.

The Avast-CTU Public CAPE Dataset is generated by CAPEv2 using 3 physical host machines, each running 4 guest VMs, for a total of 12 VM instances. The VMs run Windows 7 with MS Office, Chrome, Firefox, Adobe Reader, and Spotify, and are altered to pass anti-analysis detection, including storing a generated private key, passwords in Chrome, holding user-like documents and images, and allowing internet connectivity. Samples were executed and captured in July and August 2021, and the dataset includes 48,976 samples from 2017–2019 labeled into 10 malware families and 6 malware types. Full CAPEv2 JSON reports can reach sizes up to 800MB; reduced reports retain behavior → summary and static → pe. Captured dynamic features include process creation trees, system and API calls, filesystem activity, registry interactions, network behavior, mutexes, and YARA detections. This gives CAPE research a public corpus of high-fidelity behavioral artifacts for pattern mining and concept-drift studies.

5. Forecasting, predictability, and attack-path inference

Attack-pattern exploration is not limited to extracting present behavior; it also includes anticipating future behavior. The cited work spans spatiotemporal analysis of attack traffic, graph-based prediction of future attack steps, and hybrid statistical and ensemble-learning frameworks for seasonal cyberattack forecasting. A broader comparative survey further argues that long-range prediction should account for attack motivations, methods, targets, and the persistent role of “unknown” techniques (Chen et al., 2016, Polatidis et al., 2018, Adeniya, 4 Nov 2025, Chinanu et al., 2024).

The spatiotemporal study of cyberattacks identifies two main patterns, deterministic and stochastic, in the IP address space and reports that there are very few sets of major attackers committing almost all the attacks. Deterministic attack patterns appear as nearly parallel lines or “wall” attacks in spatiotemporal plots, while stochastic patterns are patchy and highly variable. The paper uses the flux-fluctuation law, the Markov state transition probability matrix, and information entropy. Coarse graining is defined by

$G_R = (V_N, E_K)$2

and maximal predictability is bounded through Fano’s inequality. Across all IPs, the average predictability reaches about 93%. The implication for CAPE-like systems is direct: observing attacks on one representative IP in a block can reveal with high probability the pattern over the entire block.

The attack-graph and recommendation-system approach models infrastructure as a directed graph $G_R = (V_N, E_K)$3, where nodes are assets and edges are exploitable connections or vulnerabilities. It builds all non-circular paths subject to entry points, target points, attacker location, attacker capability, vulnerability type, and maximum propagation length. A collaborative filtering stage then uses the Pearson Correlation Coefficient between assets,

$G_R = (V_N, E_K)$4

to classify future attack likelihoods as Very High, High, Medium, Low, or Very Low, with risk increased if an attack path exists. In a case study on a real port supply chain process of about 180 assets, attack graph generation time is reported as less than 2 seconds under all tested conditions.

The e-commerce forecasting framework integrates statistical modeling, inferential testing, and ensemble machine learning for CAPE-oriented temporal risk anticipation. It uses Auto ARIMA, ANOVA, Mann-Whitney U, XGBoost, LightGBM, and CatBoost on the Verizon Community Data Breach dataset. The Mann-Whitney U result $G_R = (V_N, E_K)$5 confirms significantly more severe attacks during holiday periods, average threat severity during holiday months is 0.86 versus 0.70 for non-holidays, and the best Auto ARIMA model is ARIMA(0,1,2) with RMSE 0.8784 and MAE 0.956. For breach-type classification, CatBoost achieves Accuracy 85.29%, F1 score 0.2254, and ROC AUC 0.8247. The paper explicitly frames these outputs as feeding the CAPE dashboard with upcoming risk windows and real-time severity tags.

The longer-range comparative survey adds a strategic dimension. It reports that cyber-crime increases yearly from 57% in 2012 to 77% in 2017, cyber-warfare rises from 3% to 14.5%, account hijacking grows from 2.4% to 15.5%, and malware or POS malware surges to 29.8% in 2017. It also emphasizes that “Unknown” techniques are the largest category over several years, indicating evolving or unclassified threats and gaps in threat intelligence and attack signature coverage. For CAPE, this means that prediction cannot rely only on closed taxonomies; it must also accommodate sparse, polymorphic, or not-yet-classified behaviors.

6. Detection-oriented CAPE deployments, explainability, and research issues

The BEC-detection CAPE shows how the attack-pattern idea can be operationalized in a production environment. It is organized as a two-layer pipeline: a Detection Layer composed of numerous modular, independent detectors, and a Classification Layer that aggregates detector scores and produces a final verdict. The modalities are text, images, metadata, and communication context, and the communication-context component uses a dynamically updated Mail Graph to identify rare or frequent communication patterns. The final classifier is logistic regression, updated by a Bayesian framework that combines limited data with domain knowledge (Brabec et al., 2023, Hemberg et al., 2020, Adeniya, 4 Nov 2025).

The detector layer includes Transformer-based language modules, OCR-derived image text processing, email address masquerade detection, Unicode masquerade detection, and communication frequency detectors. CAPE has over 90 detectors, each producing a score in $G_R = (V_N, E_K)$6 and metadata for explainability. Some detectors serve as benign shortcuts, allowing short-circuiting of obviously safe emails. The classification model uses interpretable weights over the detector vector, with priors centered on baseline weights and updated iteratively. The system also tracks average Shapley values and relative impact for each detector to quantify marginal contribution to convictions.

Operational results are stated in production terms. After silent deployment and iterative improvement, CAPE consistently maintains over 80% precision on positive convictions in live production. More than 50% of emails are processed in under 50ms, and 99% in under 1s. These figures matter because the paper frames CAPE not as a single large end-to-end model, but as a modular system designed around explainability, cold-start constraints, severe class imbalance, and distribution drift.

The limitations described across the literature are similarly concrete. BRON reveals blind spots and missing connections between vulnerabilities, weaknesses, CAPEC patterns, and ATT&CK tactics or techniques. The e-commerce forecasting paper notes class imbalance, reliance on historical data, moderate F1 on the minority class, and lack of adversarial robustness evaluation. The BEC-detection paper emphasizes that attacks are extremely rare, labeled benign data is scarce, and feedback on false positives and false negatives is sparse and biased. Taken together, these results indicate that CAPE systems are strongest when treated as analyst-centered, continuously updated infrastructures for pattern discovery and prioritization rather than as closed, fully complete representations of the threat landscape.