Logical models identify threat actors through evolving activity patterns
Adversary Brains: Hypothesis-Based Logical Signatures for Threat Actor Detection with LLMs
Cryptography and SecurityMachine Learning
Summary
Detecting cyber threats by relying on single clues can miss the bigger picture. The paper describes a method that builds detailed, evolving models—called adversary brains—of how threat actors behave over time. These models use language AI to turn text reports into patterns that match complex attack behaviors continuously. This approach helps spot new threats by recognizing partial similarities and updating automatically without needing constant human re-interpretation.
What this means in practice
- •For security operations teams: Continuously detect threat actor campaigns by matching evolving behavior patterns rather than single indicators.
- •For threat intelligence analysts: Convert textual threat reports into structured models that suggest new indicators and update detection criteria automatically.
Authors
Gadi Evron
Abstract
An adversary brain is an LLM-based model of a threat actor's behavior, held as an evolving logical signature: a hypothesis with enough structure that data can test it continuously, without a person re-interpreting it each time. Rather than any single observation, such as an IoC (Indicator of Compromise), it is the arrangement that becomes a detection, or intelligence, mechanism. Where YARA matches a file and Sigma matches a log line, an adversary brain matches the activity pattern of a campaign or threat actor. This is based on an intelligence analysis technique called Analysis of Competing Hypotheses (ACH), which the design lifts from the limitation of a few hypotheses at a time, to thousands, and then also operationalizes it for continuous detection purposes. Language models make the concept, and scale, practical: they turn prose reports into brains, judge matches, and drive the loop that keeps brains current. A partial pattern in a brain can also match a new value, such as a fresh C2 (command and control) domain name, assisting with the discovery of new indicators, and turning unknown unknowns into known unknowns, and potentially into knowns. The author would like to thank Ryan Moon for the collaboration, and Sounil Yu, Chris Inglis, Thomas Roccia, Marius Benthin, Israel Grimberg, Michal Kamensky, Justin Borland, Brandon Levene, John Hultquist, and John Bambenek for their feedback and assistance.