PaperlayerView exact revision on arXiv

Source-linked AI summary

A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

Matteo Lupinacci, Luigi Arena, Francesco Blefari, Angelo Furfaro

arXiv:2609.12841v1cs.CRcs.AI

TL;DR

Automated ATT&CK mapping from host behavior remains limited, while kernel telemetry offers direct but complex evidence of attacker activity. Trace2ATT&CK reconstructs that activity in provenance-based graph representations and uses LLM prompting or RAG to produce ranked technique candidates. RAG improves mapping over base prompting, and compact command graphs support reliable local inference.

  • Problem

    Automated ATT&CK mapping remains largely manual, as existing automated approaches focus on CTI reports while complex, high-volume kernel telemetry remains difficult to use.

    Source: §1 · pp. 1–2

  • Method

    Trace2ATT&CK collects kernel events with eBPF, reconstructs attacker activity in provenance graphs, derives compact graph representations, and applies LLM-based ATT&CK mapping.

    Source: §1 · p. 2

  • Results

    RAG consistently improves mapping accuracy over base prompting, up to +15, 44 HR@5 points, while compact command graphs are key to reliable local inference.

    Source: §8 · p. 11

  • Takeaways & Limitations

    Compact command graphs support local inference, while full provenance graphs are more accurate but return no output in nearly half of cases due to context limits.

    Source: §8 · p. 11

    The threat model excludes kernel-level attacks that compromise security auditing and hardware-level or side-channel attacks.

    Source: §3.1 · p. 4

Abstract

from arXiv · show

Mapping observed system behavior to standardized frameworks like MITRE ATT&CK is essential for threat-informed defense, but remains largely manual. Existing automated methods depend on Cyber Threat Intelligence reports, which offer only retrospective accounts of attacks. Low-level telemetry, i.e. kernel-level system calls, instead provides evidence of adversary behavior, yet its volume and complexity have limited its use for automated mapping. We present a methodology that collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning. These representations are mapped to the MITRE ATT&CK framework using both pure LLM prompting and retrieval-augmented generation (RAG) grounded in the ATT&CK knowledge base, producing ranked technique candidates along with supporting rationales. We implement this methodology as an end-to-end pipeline, named Trace2ATT&CK and evaluate it on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improves ATT&CK mapping performance over pure prompting, while provenance graph substantially outperforms raw telemetry. These results show that local inference over graph-based behavioral descriptions can make automated ATT&CK mapping from kernel-level telemetry operationally viable, without compromising data confidentiality.

1 Introduction

Automated ATT&CK mapping remains difficult because low-level host telemetry is voluminous and complex, while prior automated approaches mainly analyze second-hand CTI reports. The paper proposes mapping observed kernel events through provenance graphs and LLM-based reasoning, implemented in Trace2ATT&CK.

1 Introduction

  • Mapping observed events to ATT&CK is labor-intensive and error-prone at the scale of real systems, limiting its scalability for threat intelligence, incident alerts, and response.The introduction notes that modern systems generate large volumes of security events.Source: §1 · pp. 1–2
  • Raw and semi-structured host telemetry remains largely unmapped automatically, despite containing direct evidence of attacker behavior and requiring analysis of relevant events, relationships, and action sequences.Existing automated mapping has focused primarily on CTI reports, which describe attacks second-hand.Source: §1 · p. 2
  • The methodology collects kernel events with eBPF, reconstructs attacker operations in provenance graphs, and uses LLM-based systems to map the graphs to ATT&CK tactics and techniques.The authors frame the approach as behavior classification from the system itself rather than analysis of reports about attackers.Source: §1 · p. 2
  • Trace2ATT&CK implements the methodology as an end-to-end pipeline, and the authors release kernel-level logs collected while executing Atomic Red Team scenarios.The pipeline combines telemetry collection, attacker-session anchoring, provenance-aware reconstruction, command–event correlation, and raw and compressed weighted command graphs.Source: §1 · p. 2

2 Background and Related Work

The background describes kernel-level telemetry as a detailed view of system activity and reviews ATT&CK mapping approaches that rely on CTI, detection rules, or other runtime evidence. Trace2ATT&CK is positioned as mapping bounded execution activity using provenance-grounded reconstruction.

2.1 Low-level Telemetry

  • Kernel-level telemetry captures fine-grained events such as process executions, file operations, network connections, and inter-process communications, supporting monitoring and forensic reconstruction.It is presented as a source-adjacent view of system activity rather than an aggregated summary.Source: §2.1 · p. 2

2.2 MITRE ATT&CK Mapping Approaches

  • ATT&CK mapping supports threat hunting, incident response, and detection-coverage assessment, while rule-based platforms depend on available information sources and predefined detection coverage.Those dependencies limit identification of emerging techniques or attack variants not yet modeled by the rules.Source: §2.2 · pp. 2–3

2.3 Related Work

  • Trace2ATT&CK starts from observed runtime activity and uses provenance-grounded reconstruction, unlike CTI-driven approaches that require campaign knowledge to generate representative evidence.Unlike LADE’s analysis of command and script snippets, it assumes a pre-delimited attack interval and uses causal relations from kernel telemetry.Source: §2.3 · p. 3
  • The paper distinguishes provenance-derived execution flows from mappings of detection-rule text or metadata, because runtime events gain meaning through command, process, and temporal context.Its output is a ranked set of techniques rather than a single classification.Source: §2.3 · p. 3

3 Problem Statement

The paper targets contextual enrichment and reconstruction of events within an already identified attack interval, rather than anomaly detection. Its threat model assumes trusted kernel-level auditing and excludes attacks that compromise auditing and hardware-level or side-channel attacks.

3 Problem Statement

  • Given host-level events from a pre-selected malicious-activity window, the system aims to enrich the sequence with ATT&CK techniques and transparent rationales by correlating events into a unified narrative.The design goals are context sensitivity, local execution, and interpretability.Source: §3 · p. 3
  • The method assumes the attack interval is already delimited; anomaly detection is outside its scope, though it could precede the method to identify that window.The stated focus is fine-grained semantic enrichment within the known interval.Source: §3 · p. 3

3.1 Threat Model

  • The threat model excludes kernel-level attacks that deliberately compromise security auditing, as well as hardware-level and side-channel attacks.The authors assume existing system-hardening techniques mitigate potential audit-framework compromise.Source: §3.1 · p. 4

4 Methodology

The methodology collects kernel-level telemetry, reconstructs system activity as provenance graphs, and maps serialized graphs to ranked ATT&CK candidates using LLM prompting or retrieval-augmented generation. It uses causal structure and contextual ATT&CK descriptions to support classification and analyst review.

4.1 Data Collection

  • eBPF supplies kernel-level telemetry; its programs can be statically verified, attached to kernel hook points at runtime, and used to filter or aggregate data before it reaches user space.The paper notes that the collection step can also be performed with another eBPF program by extracting the specified features from raw logs.Source: §4.1 · p. 4

4.2 Provenance Graph

  • The provenance graph represents processes, files, and sockets as entities connected by directed interaction edges, preserving causal relationships for attack reconstruction.A process-centric community groups a master process with entities causally reachable from it, forming a subgraph of coherent adversarial activity.Source: §4.2 · pp. 4–5

4.3 Mapping Approach

  • Serialized provenance graphs are classified by LLMs using pure prompting or RAG, which supplies retrieved ATT&CK descriptions as factual context.The system returns ranked top-k technique candidates with tactic, confidence score, and rationale; ranking retains plausible alternatives when behaviors resemble multiple techniques.Source: §4.3 · p. 5

5 Dataset

The dataset uses Atomic Red Team tests with technique-linked labels, while command-line identifiers are sanitized to prevent direct label leakage. Executions yield a large collection of kernel logs.

5 Dataset

  • Atomic Red Team tests provide technique-aligned ground truth through their technique identifiers, avoiding manual annotation.The tests are executed with Invoke-AtomicRedTeam, which supports controlled invocation, prerequisites, cleanup, and logging.Source: §5 · p. 5
  • ATT&CK identifiers are replaced with placeholders in command lines before inference to prevent the LLM from recovering labels directly.For example, T1059 becomes TXXXX.Source: §5 · p. 5
  • The dataset contains 21.950.327 raw log lines totaling 29,8 GB, collected during execution of the evaluation attacks.Source: §5 · p. 5

6 Trace2ATT&CK Design and Implementation

Trace2ATT&CK collects kernel telemetry, reconstructs attacker activity as provenance and weighted command graphs, and uses LLM prompting or RAG to map behavior to ATT&CK. Its evaluation assumes remote-shell access and runs inference locally.

6 Trace2ATT&CK Design and Implementation

  • The pipeline assumes an attacker issues commands through a remote shell and processes one attack scenario through telemetry collection, graph construction, command extraction, and LLM classification.Classification uses either pure prompting or RAG.Source: §6 · p. 6

6.1 Telemetry Collection and Preprocessing

  • A Rust-based preprocessor transforms raw Tracee output by filtering noise, projecting events onto canonical fields, splitting streams into ordered 10,000-record files, and optionally serializing them in token-efficient TOON.After preprocessing, the analyzed logs comprise 21.823.051 lines totaling 9,7 GB, averaging more than 62K lines per attack scenario; collection can use any eBPF program that extracts the described features.Source: §6.1 · p. 6

6.2 Provenance Graph Construction

  • Provenance construction identifies the attacker shell, correlates issued commands with execve events, and traverses descendant processes to attach reconstructed commands and local event streams.If shell logging misses a command, unmatched execve events provide a fallback; the resulting graph restricts nodes to processes and commands, with file and network details retained in command arguments.Source: §6.2 · pp. 6–7

6.3 Command Graph Extraction

  • Weighted command graphs aggregate repeated command patterns by execution frequency, offering full and compressed representations for downstream reasoning.The compressed view normalizes commands by base binary and option flags; if a full DOT graph exceeds 15,000 characters, the system falls back to the compressed representation.Source: §6.3 · p. 7

6.4 LLM Prompting

  • LLM prompting requests ranked ATT&CK candidates with rationales grounded in the full command flow, while RAG retrieves five relevant ATT&CK knowledge-base chunks as factual context.The prompt requires sub-techniques when warranted; RAG uses MMR retrieval from a local vector store.Source: §6.4 · p. 7

6.5 Experimental Setup

  • Evaluation uses a two-VM setup, with the pipeline and target environment separate from locally run LLM inference; seven local LLMs are tested.The inference VM uses two NVIDIA L40S GPUs, and reported metrics exclude unparsable model outputs.Source: §6.5 · p. 7

7 Results and Ablation Study

Across the evaluated configurations, RAG improved ATT&CK mapping, while results also varied with model capability and attack completion. Ablations show that graph representation strongly affects mapping quality and output reliability under bounded context windows.

7.1 Quantitative Results

  • Under taxonomy-grounded prompting, gpt-oss-120b reached HR@5 = 64, 64% for techniques and 43, 66% for exact sub-techniques; taxonomy grounding raised scores across models and settings.The 8B foundation-sec-8b-reasoning model also outperformed larger general-purpose models under base prompting, including llama-3.3-70b-instruct (49, 2% vs. 35, 26%).Source: §7.1 · pp. 8–9
  • With RAG, gpt-oss-120b achieved the highest HR@5 at both levels: 66, 57% for techniques and 46, 26% for sub-techniques.Gemma-4-31-b followed at the technique level with HR@5 = 65, 42%.Source: §7.1 · p. 9
  • RAG improved HR@5 in all 14 model-criteria combinations, averaging ∼5, 52 points for techniques and ∼8, 03 points for exact sub-techniques.Technique-level gains ranged from +1, 78 to +10, 66 points; exact sub-technique gains ranged from +0.93 to +15, 44 points.Source: §7.1 · p. 9
  • For foundation-sec-8b under base prompting, technique HR@5 was 49, 67% on successful attacks and 48, 75% on failed attacks, while exact sub-technique results favored successful attacks.Under RAG, gpt-oss120b's exact sub-technique HR@5 was 60, 36% on successful attacks versus 31.07% on failed attacks; the paper concludes technique-level triage retains more value on interrupted attacks.Source: §7.1 · p. 9
  • Claude-Sonnet-5 reached HR@5 of 90,91% for techniques and 74,76% for exact sub-techniques, with no meaningful RAG improvement.The authors interpret the local-model gap as primarily reflecting model capacity rather than methodological limitations.Source: §7.1 · p. 9
  • The evaluation compares Trace2ATT&CK's 347 Linux Atomic Red Team cases with LADE's 35 attack sequences, whose snippets averaged about 990 code snippets and 4.8 non-empty lines each.Trace2ATT&CK scenarios averaged ∼62𝐾 raw eBPF event lines, which the authors describe as closer to realistic operational deployment.Source: §7.1 · p. 9

7.2 Ablation Study

  • Raw logs achieved HR@5 = 37, 88% for techniques and 19, 57% for exact sub-techniques, with empty outputs in 56, 73% and 53, 1% of cases, respectively.The authors attribute degradation to verbose redundant events, implicit causal links, and context-window limits.Source: §7.2 · p. 10
  • Full provenance graphs reached HR@5 = 69, 27% for techniques and 46, 81% for exact sub-techniques when inputs fit, but produced empty outputs in up to 49, 76% of cases; compact command graphs had 0, 0% empty outputs.The compact representation never exceeded the context budget, making it the more practical bounded-resource choice despite a modest per-case accuracy trade-off.Source: §7.2 · p. 10

8 Conclusion

Trace2ATT&CK maps eBPF-collected kernel telemetry to ATT&CK through provenance and compact weighted command graphs. RAG improves mapping accuracy over base prompting, while compact graphs support more reliable local inference.

8 Conclusion

  • The methodology collects system calls via eBPF, reconstructs attacker-associated process trees into provenance graphs, and derives compact weighted command-graph representations.Source: §8 · p. 11
  • The evaluation covers Atomic Red Team scenarios across seven locally deployed LLMs using base prompting, taxonomy-grounded prompting, and RAG.Source: §8 · p. 11
  • RAG consistently improves mapping accuracy over base prompting, especially for smaller models, while a security-specialized 8B model rivals much larger general-purpose models.The system degrades gracefully on incomplete attacks, preserving technique-level accuracy; Claude-Sonnet-5 validation reports HR@5 = 90, 91%.Source: §8 · p. 11
  • Compact command graphs are key to reliable local inference, although full provenance graphs are more accurate and return no output in nearly half of cases due to context limits.Source: §8 · p. 11

A Evaluation Metrics

The evaluation uses three ranking metrics to assess whether the correct ATT&CK label appears in the predictions and how highly it is ranked.

A Evaluation Metrics

  • HR@K measures the percentage of test cases where the correct label appears anywhere in the top K predictions, regardless of position.Source: A Evaluation Metrics · p. 12
  • MRR@K rewards correct labels ranked nearer the top and assigns zero when the label falls outside the top K.Source: A Evaluation Metrics · p. 12
  • With exactly one relevant label per case, ideal DCG@K is always 1, and NDCG@K provides a rank-sensitive score that penalizes lower-ranked matches less sharply than MRR.Source: A Evaluation Metrics · p. 12

B Invalid JSON output during evaluation tests

Table 5 reports invalid JSON output counts for each model, with and without RAG.

B Invalid JSON output during evaluation tests

  • Table 5 reports the number of invalid JSON outputs for each model, with and without RAG.Source: Table 5 · p. 12

C System Prompt

The system prompt directs the LLM to analyze a complete command graph and map the entire attacker sequence to ranked ATT&CK techniques. It requires sub-technique specificity where supported, confidence scores, and flow-based rationales in a JSON response.

C System Prompt

  • Analyze the complete DOT-file command graph, including all nodes, edges, and the flow from start to finish, rather than isolated commands.Source: C System Prompt · p. 13
  • Map the whole attacker sequence to the five most appropriate ATT&CK techniques, considering how commands relate across the workflow.Source: C System Prompt · p. 13
  • When behavior supports a sub-technique, the prompt requires mapping to that sub-technique rather than only its parent technique.Source: C System Prompt · p. 13
  • Each mapping needs a confidence value and a rationale based on the complete attack flow, not a single isolated command.Source: C System Prompt · p. 13
  • Return only a JSON array, with each entry containing the tactic, technique and ID, confidence, and rationale.Source: C System Prompt · p. 13
Loading 2609.12841v1…