  The techniques and tactics used by cyber adversaries are becoming more
sophisticated, ironically, as defense getting stronger and the cost of a breach
continuing to rise. Understanding the thought processes and behaviors of
adversaries is extremely challenging as high profile or even amateur attackers
have no incentive to share the trades associated with their illegal activities.
One opportunity to observe the actions the adversaries perform is through the
use of Intrusion Detection Systems (IDS) which generate alerts in the event
that suspicious behavior was detected. The alerts raised by these systems
typically describe the suspicious actions via the form of attack 'signature',
which do not necessarily reveal the true intent of the attacker performing the
action. Meanwhile, several high level frameworks exist to describe the sequence
or chain of action types an adversary might perform. These frameworks, however,
do not connect the action types to observables of standard intrusion detection
systems, nor describing the plausible intents of the adversarial actions. To
address these gaps, this work proposes the Action-Intent Framework (AIF) to
complement existing Cyber Attack Kill Chains and Attack Taxonomies. The AIF
defines a set of Action-Intent States (AIS) at two levels of description: the
Macro-AIS describes 'what' the attacker is trying to achieve and the Micro-AIS
describes "how" the intended goal is achieved. A full description of both the
Macro is provided along with a set of guiding principals of how the AIS is
derived and added to the framework.
