A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

2026-09-11

AI Summary

本文提出一种基于图的方法，通过收集内核级事件并转化为图表示，利用LLM和RAG技术将其映射到MITRE ATT&CK框架，实现自动化威胁行为分析。

Abstract

Mapping observed system behavior to standardized frameworks like MITRE ATT&CK is essential for threat-informed defense, but remains largely manual. Existing automated methods depend on Cyber Threat Intelligence reports, which offer only retrospective accounts of attacks. Low-level telemetry, i.e. kernel-level system calls, instead provides evidence of adversary behavior, yet its volume and complexity have limited its use for automated mapping. We present a methodology that collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning. These representations are mapped to the MITRE ATT&CK framework using both pure LLM prompting and retrieval-augmented generation (RAG) grounded in the ATT&CK knowledge base, producing ranked technique candidates along with supporting rationales. We implement this methodology as an end-to-end pipeline, named Trace2ATT&CK and evaluate it on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improves ATT&CK mapping performance over pure prompting, while provenance graph substantially outperforms raw telemetry. These results show that local inference over graph-based behavioral descriptions can make automated ATT&CK mapping from kernel-level telemetry operationally viable, without compromising data confidentiality.

Problem

• Kernel-Level Telemetry
• MITRE ATT&CK
• Threat-Informed Defense
• Cyber Threat Intelligence
• Automated Mapping

Innovation

• graph-based approach
• kernel-level telemetry
• provenance graph
• retrieval-augmented generation (RAG)
• MITRE ATT&CK