A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

원문 초록

Mapping observed system behavior to standardized frameworks such as MITRE ATT&CK is essential for threat-informed defense. Existing automated methods mostly depend on Cyber Threat Intelligence reports, which offer only retrospective accounts of attacks. Kernel-level telemetry, i.e., system calls, instead provides first-hand evidence of adversary behavior, but its volume and complexity have limited its use for automated mapping. Its content also makes it unsuitable for cloud-based analysis: command lines carry credentials, events carry user identifiers and network endpoints, and during an incident the telemetry reveals which defenses failed. In this work, we present Trace2ATT&CK, a framework that maps kernel-level telemetry to ATT&CK techniques entirely within the defender's infrastructure. Trace2ATT&CK collects events via eBPF, reconstructs the attacker's activity as a process-centric provenance graph, and condenses it into a compact execution graph. This graph is classified by locally deployed open-weight LLMs, using either pure prompting or retrieval-augmented generation (RAG) grounded in the ATT&CK knowledge base, producing ranked technique candidates with supporting rationales. We evaluate Trace2ATT&CK on 347 Linux Atomic Red Team tests with seven open-weight LLMs. The best local configuration reaches an HR@5 of 66.57\% at the technique level. RAG improves over base prompting in every model and setting, by up to $+15.44$ percentage points, and the execution graph substantially outperforms raw telemetry while never exceeding the LLM context window. Finally, a frontier cloud model used as an upper-bound reference quantifies the cost of local inference at 24--28 percentage points. These results show that ATT&CK mapping from kernel-level telemetry is feasible without disclosing sensitive evidence to third-party services.