The Diamond Model of Intrusion Analysis (2013) [pdf]

[bootload]

https://www.threatconnect.com/wp-content/uploads/ThreatConnect-The-Diamond-Model-of-Intrusion-Analysis.pdf

[bwoj]

I deplore the practice of publishing papers without a date. This could have been written any time between 2012 and last week based on the sources referenced.

[dang → bwoj]

It mentions 2013 in the text, and there's no sign of 2014+, so we'll call it 2013.

[smoyer → dang]

Good call - the paper was published July 5th, 2013. I believe it was originally published here:

http://www.dtic.mil/docs/citations/ADA586960

I should also note that this paper is worth reading if simply to make one aware of how to view an intrusion from different perspectives.