MITRE D3FEND: a knowledge graph of defensive techniques

What it is

D3FEND (Detection, Denial and Disruption Framework Empowering Network Defense) is a structured vocabulary of defensive techniques, managed by MITRE and funded by the US National Security Agency’s Cybersecurity Directorate. Unlike a list of controls, it is an ontology: a formal model in which every technique, artefact and relationship has a defined meaning that software can reason about.

The central idea is the digital artefact. An attacker technique acts on artefacts (a process, a file, a network flow, a user account, a DNS query). A defensive technique also acts on artefacts. By linking both sides through the same artefacts, D3FEND can infer which countermeasures are relevant to which attacks without anyone hand-writing every mapping.

Why it matters

Security teams often struggle to answer simple questions such as "what exactly does this product do?" or "which of our controls actually address credential dumping?". Marketing language makes products sound similar. D3FEND gives precise, neutral names, for example Certificate Analysis, Process Spawn Analysis or Network Traffic Filtering, so capabilities can be compared and gaps found. It also helps researchers and educators describe defences consistently.

Key ideas

• Tactics and techniques. Defensive techniques are grouped under seven tactics: Model, Harden, Detect, Isolate, Deceive, Evict and Restore.
• Artefacts link attack and defence. For example, an ATT&CK technique that modifies a scheduled task and a D3FEND technique that analyses scheduled job creation both relate to the "scheduled job" artefact.
• References. Each technique cites the sources it was derived from, such as patents, academic papers and standards, so you can see where the idea came from.
• Machine-readable. The ontology is published in formats that tools can load, which allows automated mapping and querying.

A concrete example shows how the pieces fit. Consider an attacker who steals credentials from the memory of a Windows authentication process. In ATT&CK this is a credential dumping technique acting on a process memory artefact. D3FEND lists defences that relate to the same artefacts, such as hardening that restricts which processes may read that memory, detection techniques that analyse process access patterns, and evicting the attacker by resetting compromised credentials. The result is not a single answer but a structured menu of options across several tactics, which is exactly how layered defence should be planned.

What changed recently

D3FEND 1.0 was released in December 2024 and announced in January 2025. The milestone was about stability: a stable, extensible model aligned with formal upper ontologies, plus new access control concepts, so that tool builders could integrate it without fearing constant breaking changes. Alongside it MITRE introduced D3FEND CAD, a drag-and-drop diagramming tool. You draw a scenario (attacker actions, artefacts, defences) using D3FEND classes, and the tool can infer relationships from the ontology. Since 1.0 the project has continued to add techniques and mappings, including operational technology content.

How practitioners apply it

1. Describe your controls in D3FEND terms. Translate product features and in-house scripts into D3FEND techniques. This exposes overlap where three tools do the same thing.
2. Link to priority attacks. Start from the ATT&CK techniques you care about, follow the artefacts, and list candidate countermeasures.
3. Model incidents and architectures with CAD. Draw how an intrusion progressed and where each defence could have acted.
4. Use it in procurement. Ask vendors to state which D3FEND techniques they implement and on which artefacts and platforms.
5. Teach with it. It is a good structure for labs: each exercise implements one technique, such as network segmentation (an Isolate technique, see segmentation).

Limitations and open questions

• Mappings are not proof of effectiveness. A relationship between a defence and an attack shows relevance, not that the defence will stop the attack in your environment.
• Steep learning curve. Ontology terms and graph tools are unfamiliar to many operations teams.
• Coverage is uneven across platforms, and cloud and OT content is still growing.
• Adoption. Vendor support is improving but far from universal, so manual mapping is still common.

For students, D3FEND is also a useful research tool. Because each technique cites its sources, it is an organised entry point into the academic and patent literature on a defensive idea, which helps when writing a literature review or justifying a design choice in a dissertation. Combining it with ATT&CK in a single coverage table, attack technique on one axis and defensive technique on the other, is a simple way to present a defence-in-depth argument.