A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK
Trace2ATT&CK maps eBPF kernel telemetry to MITRE ATT&CK via provenance graphs and RAG with local open-weights LLMs, validated on 347 Atomic Red Team tests.
Trace2ATT&CK collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning, mapping behavior to MITRE ATT&CK techniques with ranked candidates and rationales. Mapping uses both pure LLM prompting and retrieval-augmented generation grounded in the ATT&CK knowledge base. It was evaluated on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improved ATT&CK mapping over pure prompting, and provenance graphs substantially outperformed raw telemetry, without compromising data confidentiality.
- eBPF-collected kernel events correlated into attacker-command provenance graphs.
- RAG grounded in ATT&CK knowledge base beats pure LLM prompting.
- Provenance graphs substantially outperform raw telemetry for mapping.
- Evaluated on 347 Linux Atomic Red Team tests with open-weights LLMs.
- Local inference preserves data confidentiality during automated mapping.
Full article182 words · extracted from arxiv.org · click to collapse
Mapping observed system behavior to standardized frameworks like MITRE ATT&CK is essential for threat-informed defense, but remains largely manual. Existing automated methods depend on Cyber Threat Intelligence reports, which offer only retrospective accounts of attacks. Low-level telemetry, i.e. kernel-level system calls, instead provides evidence of adversary behavior, yet its volume and complexity have limited its use for automated mapping. We present a methodology that collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning. These representations are mapped to the MITRE ATT&CK framework using both pure LLM prompting and retrieval-augmented generation (RAG) grounded in the ATT&CK knowledge base, producing ranked technique candidates along with supporting rationales. We implement this methodology as an end-to-end pipeline, named Trace2ATT&CK and evaluate it on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improves ATT&CK mapping performance over pure prompting, while provenance graph substantially outperforms raw telemetry. These results show that local inference over graph-based behavioral descriptions can make automated ATT&CK mapping from kernel-level telemetry operationally viable, without compromising data confidentiality.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.12841