A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK
Matteo Lupinacci, Luigi Arena, Francesco Blefari, Angelo Furfaro
cs.CR · cs.AI
Quick verdict
Claims eBPF provenance graphs + LLM/RAG enable automated ATT&CK mapping from kernel telemetry; 347-test eval is solid, ablated, but statistically thin.
Summary
The paper presents Trace2ATT&CK, an end-to-end pipeline mapping kernel-level Linux telemetry to MITRE ATT&CK techniques. eBPF (Tracee) captures syscall events; a Rust preprocessor filters and chunks them; the pipeline identifies the attacker shell, correlates commands with their system effects, and builds a Neo4j provenance graph restricted to Process and Command nodes, from which weighted command-graph DOT representations are derived (with a compressed fallback). These feed local LLMs under three paradigms: base prompting, taxonomy-grounded prompting, and RAG over the ATT&CK knowledge base (Chroma, mxbai-embed-large-v1, MMR). Evaluation covers 347 Linux Atomic Red Team tests (166 executed successfully, 181 failed at runtime; ~62K log lines per scenario, 29.8 GB raw), with technique IDs sanitized to prevent label leakage. RAG improves HR@5 over base prompting in all 14 model-criteria comparisons (average +5.52 technique-level, +8.03 sub-technique-level points). The best local model, gpt-oss-120b, reaches 66.57% technique and 46.26% sub-technique HR@5 with RAG; Claude Sonnet-5 reaches 90.91% and 74.76%. Ablations show raw logs (19.57% sub-technique HR@5, over half empty outputs) and full provenance graphs (~half empty outputs) are impractical at a 32K context, while command graphs never overflow. Main limitations: unparsable outputs are excluded from metric denominators, there is no significance testing, 181 failed executions keep intended labels, and the method relies on a pre-delimited attack window.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- RAG improves ATT&CK mapping over base prompting in all 14 model-criteria comparisons (average +5.52 technique-level and +8.03 sub-technique-level HR@5 points).
- Provenance-derived weighted command graphs substantially outperform raw kernel telemetry (sub-technique HR@5 43.66% vs 19.57% under gpt-oss-120b with taxonomy-grounded prompting).
- Compact command graphs never exceed the 32K context budget, whereas full provenance graphs return empty outputs in up to 49.76% of cases.
- A security-specialized 8B model rivals far larger general-purpose models, and Claude Sonnet-5's 90.91% technique HR@5 validates the pipeline's soundness.
Strengths
Real-scale evaluation with leakage control
347 Linux ART tests (~62K preprocessed lines each; 21,823,051 lines / 9.7 GB after preprocessing, §6.1), with ATT&CK IDs sanitized to TXXXX placeholders before inference (§5) — a fairness step many ART-based LLM evaluations omit.
Ablations answer RQ2 with actionable negative results
§7.2 quantifies raw logs (sub-tech HR@5 19.57%; 53.1-56.73% empty outputs) and full PG (~45.93-49.76% empty at 32K) against the command graph (0% empty), justifying the compact representation with data rather than intuition.
Transparent failure-mode reporting
Practical deployment finding
Precise positioning against related work
Weaknesses
Metric denominators exclude unparsable outputs
No statistical uncertainty
Ground-truth semantics on failed executions
Operational assumptions outrun the motivating scenario
Missing non-LLM baseline; ablation on one model
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
Trace2ATT&CK (arXiv 2609.12841) addresses automated mapping of kernel-level Linux telemetry to MITRE ATT&CK techniques, positioned against the dominant family of CTI-report-based mappers (§2.2–2.3). Crucially, the system is not a detector: it assumes a pre-delimited attack window (§3) in which it identifies the attacker shell, correlates issued commands with their system effects, builds a Neo4j provenance graph reduced to Process/Command nodes (§6.2), serializes weighted command graphs as DOT (§6.3), and asks a local LLM for a top-5 ranked technique list with rationales under three paradigms — base prompting, taxonomy-grounded prompting (full ID-to-name map injected, §7.1), and RAG over ATT&CK Enterprise (Chroma + mxbai-embed-large-v1, MMR λ=0.5, top-5 of 800-word chunks, §6.4). Headline claims: RAG consistently beats base prompting; graph representations beat raw telemetry; local inference makes telemetry-to-ATT&CK mapping operationally viable without cloud exposure.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is Trace2ATT&CK?
It is an end-to-end pipeline that maps Linux kernel-level telemetry (system calls collected via eBPF/Tracee) to MITRE ATT&CK techniques. It reconstructs the attacker's process tree as a provenance graph, compacts it into weighted command graphs, and uses locally deployed LLMs — with plain prompting, taxonomy-grounded prompting, or RAG over the ATT&CK knowledge base — to return the top-5 candidate techniques with rationales.
How accurate is the ATT&CK mapping?
On 347 Linux Atomic Red Team tests, the best local model (gpt-oss-120b with RAG) places the correct technique in its top-5 for 66.57% of cases and the exact sub-technique for 46.26%. The frontier Claude Sonnet-5 reaches 90.91% and 74.76% respectively. Raw log input is far weaker at 37.88% / 19.57%.
Why not feed raw system logs directly to an LLM?
The paper's ablation shows raw eBPF logs achieve only 19.57% sub-technique HR@5 and produce empty outputs in 53-57% of cases because long traces exceed the 32K-token context. Command graphs make causal relations explicit, fit the context budget, and never produce empty outputs.
Does the method require knowing when the attack happened?
Yes. The system assumes a pre-defined attack time window and identifies the attacker shell within it; anomaly detection to find that window is explicitly out of scope, so a separate triage or alerting step is needed in practice.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Tables and body text use European decimal commas in the PDF extraction (e.g., '49, 2%' = 49.2%); all numbers in this review were parsed accordingly.
- Figure 1/2 rendered text is garbled by extraction; figure-level judgments rely on the surrounding body text, which is complete through Appendix C (no truncation detected).
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.