A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

Trace2ATT&CK: An eBPF and Provenance Graph Pipeline for Automated Technique Mapping with Local LLMs

Matteo Lupinacci; Luigi Arena; Francesco Blefari; Angelo Furfaro· 2026· DOI 10.48550/arXiv.2609.12841

The core problem

Mapping observed system behavior to standardized frameworks like MITRE ATT&CK is essential for threat-informed defense, but remains largely manual. Existing automated methods depend on Cyber Threat Intelligence (CTI) reports, which offer only retrospective accounts of attacks. Low-level telemetry, i.e., kernel-level system calls, instead provides evidence of adversary behavior, yet its volume and complexity have limited its use for automated mapping. This work addresses the gap by presenting a methodology that leverages kernel-level events to automatically map adversary behavior to MITRE ATT&CK techniques. The authors implement this methodology as an end-to-end pipeline, named Trace2ATT&CK, and evaluate it on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. The approach aims to make automated ATT&CK mapping from kernel-level telemetry operationally viable without compromising data confidentiality.

The methodology was evaluated on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. The key findings are: - **RAG vs. Pure Prompting**: RAG consistently improves ATT&CK mapping performance over pure prompting. This indicates that grounding the LLM in the ATT&CK knowledge base enhances the accuracy and relevance of technique candidates. - **Provenance Graph vs. Raw Telemetry**: Provenance graph representations substantially outperform raw telemetry. The compact graph structure provides a more effective input for LLM reasoning, likely due to reduced noise and preserved causal relationships. - **Operational Viability**: The results demonstrate that local inference over graph-based behavioral descriptions can make automated ATT&CK mapping from kernel-level telemetry operationally viable, without compromising data confidentiality. Quantitative results are not provided in the abstract, but the consistent improvements highlight the effectiveness of the proposed approach.

Mapping observed system behavior to standardized frameworks like MITRE ATT&CK is essential for threat-informed defense, but remains largely manual. Existing automated methods depend on Cyber Threat Intelligence (CTI) reports, which offer only retrospective accounts of attacks. Low-level telemetry, i.e., kernel-level system calls, instead provides evidence of adversary behavior, yet its volume and complexity have limited its use for automated mapping. This work addresses the gap by presenting a methodology that leverages kernel-level events to automatically map adversary behavior to MITRE ATT&CK techniques. The authors implement this methodology as an end-to-end pipeline, named Trace2ATT&CK, and evaluate it on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. The approach aims to make automated ATT&CK mapping from kernel-level telemetry operationally viable without compromising data confidentiality.

The methodology consists of three main stages: (1) kernel-level event collection via eBPF, (2) provenance graph construction and compaction, and (3) LLM-based mapping to MITRE ATT&CK.

The study demonstrates that kernel-level telemetry, when transformed into compact provenance graphs, can be effectively used for automated mapping to MITRE ATT&CK. This addresses a critical gap in threat-informed defense, where manual mapping is labor-intensive and CTI-based methods are retrospective. By leveraging eBPF for low-level event collection and local LLMs for inference, the approach ensures data confidentiality, making it suitable for sensitive environments. The use of RAG further enhances mapping accuracy by grounding the LLM in the ATT&CK knowledge base, reducing hallucinations and improving the relevance of technique candidates. The substantial performance gain from provenance graphs over raw telemetry underscores the importance of structured behavioral representations in LLM-based reasoning. Limitations include the evaluation being limited to Linux Atomic Red Team tests; generalization to other platforms and real-world attacks requires further study. The reliance on locally deployed open-weights LLMs may also constrain performance compared to larger proprietary models, though it ensures privacy. Future work could explore adaptive graph compaction, multi-modal telemetry, and integration with real-time detection systems. Overall, Trace2ATT&CK represents a significant step towards automated, privacy-preserving ATT&CK mapping from kernel-level telemetry, with promising results that warrant further investigation.

CS practitioners and researchers

Opening member content…