Skip to content
NewA calmer, faster ZeroHour
Researchinfo

A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

arXiv cs.CRby Matteo Lupinacci ()1 min read3 · 2 reads
Read at arxiv.org
AI summary · glm-5.3Summaries by Vani AI

Trace2ATT&CK maps eBPF kernel telemetry to MITRE ATT&CK via provenance graphs and RAG with local open-weights LLMs, validated on 347 Atomic Red Team tests.

Trace2ATT&CK collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning, mapping behavior to MITRE ATT&CK techniques with ranked candidates and rationales. Mapping uses both pure LLM prompting and retrieval-augmented generation grounded in the ATT&CK knowledge base. It was evaluated on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improved ATT&CK mapping over pure prompting, and provenance graphs substantially outperformed raw telemetry, without compromising data confidentiality.

Key facts
  • eBPF-collected kernel events correlated into attacker-command provenance graphs.
  • RAG grounded in ATT&CK knowledge base beats pure LLM prompting.
  • Provenance graphs substantially outperform raw telemetry for mapping.
  • Evaluated on 347 Linux Atomic Red Team tests with open-weights LLMs.
  • Local inference preserves data confidentiality during automated mapping.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
detectionebpfkernel-telemetryllmmitre-attckprovenance-graphrag

From the original article

1 min read at arxiv.org

Mapping observed system behavior to standardized frameworks like MITRE ATT&CK is essential for threat-informed defense, but remains largely manual. Existing automated methods depend on Cyber Threat Intelligence reports, which offer only retrospective accounts of attacks. Low-level telemetry, i.

arXiv cs.CR

By Matteo Lupinacci · arxiv.org

Read the full article at arXiv cs.CR

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.