MEvince Knowledge-Constrained Framework Identifies Malware ATT&CK Techniques
Original title: MEvince: Knowledge-Constrained LLM Reasoning for Technique Identification from Malware Reports
MEvince uses shared behavioral representations and evidence-aligned retrieval to improve exact-ID F1 by 17.4% on 610 malware reports.
Mapping malware reports to ATT&CK techniques is challenging due to scattered evidence and subtle differences. MEvince builds a representation through agentic mining of documentation. Primitive-guided extraction and concept-guided retrieval validate evidence and retain candidates for comparison.
- Shared behavioral representation connects observations to technique definitions
- Primitive-guided extraction structures observations and links to passages
- Evidence-aligned retrieval matches dispersed evidence to profiles
- Exact-ID F1 improved by 17.4% over strongest baseline
- Concept-guided retrieval increases candidate coverage to 47.9%
- AI models
- LLMs
From the original article
1 min read at arxiv.orgMapping behavioral intelligence in malware analysis reports to ATT&CK techniques supports threat analysis and defense, but reliable identification remains challenging. Supporting evidence is often scattered across long, heterogeneous reports, while closely related techniques share behavioral cues and differ only in subtle but decisive details.
By Hongyu She · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.