Graph method links kernel events to mitre attack techniques effectively
A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK
Cryptography and SecurityArtificial Intelligence
Summary
Detecting cyberattacks requires matching how computers behave with known attack patterns, but this is usually done by hand. The authors show how low-level computer events can be turned into a visual map that helps computers understand which attacks happened. By using this map and special language AI tools, their system guesses the best matching known attack types, doing better than older methods. This approach keeps data private and works well on real test attacks.
What this means in practice
- •For security operations teams: Match low-level system events automatically to known attack techniques to improve threat detection accuracy and speed.
- •For enterprise incident responders: Use a local pipeline to analyze kernel telemetry privately and identify adversary actions by linking to standard frameworks without cloud dependence.
Authors
Matteo Lupinacci, Luigi Arena, Francesco Blefari, Angelo Furfaro
Abstract
Mapping observed system behavior to standardized frameworks like MITRE ATT&CK is essential for threat-informed defense, but remains largely manual. Existing automated methods depend on Cyber Threat Intelligence reports, which offer only retrospective accounts of attacks. Low-level telemetry, i.e. kernel-level system calls, instead provides evidence of adversary behavior, yet its volume and complexity have limited its use for automated mapping. We present a methodology that collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning. These representations are mapped to the MITRE ATT&CK framework using both pure LLM prompting and retrieval-augmented generation (RAG) grounded in the ATT&CK knowledge base, producing ranked technique candidates along with supporting rationales. We implement this methodology as an end-to-end pipeline, named Trace2ATT&CK and evaluate it on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improves ATT&CK mapping performance over pure prompting, while provenance graph substantially outperforms raw telemetry. These results show that local inference over graph-based behavioral descriptions can make automated ATT&CK mapping from kernel-level telemetry operationally viable, without compromising data confidentiality.