Agentic data science with the Data Agent Kit
cloud.google.com·6h ago
AI Research
arXiv CS.AI·28d ago·5 min read
A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK
TL;DR
A new methodology called Trace2ATT&CK automates the mapping of kernel-level telemetry to the MITRE ATT&CK framework, significantly improving threat detection. By utilizing eBPF and graph representations, it enhances the accuracy of identifying adversary techniques.
✦ Why It Matters
Implement Trace2ATT&CK to enhance your organization's automated threat detection capabilities today.
Key Takeaways
- Utilize eBPF for efficient kernel-level event collection.
- Adopt Trace2ATT&CK for automated ATT&CK mapping.
- Leverage RAG to improve mapping accuracy.
- Implement provenance graphs for better threat detection.
How It Works
Trace2ATT&CK collects kernel-level telemetry using eBPF, which allows for efficient monitoring of system calls. It constructs a provenance graph that correlates commands executed by attackers, providing a structured representation of their behavior.
This graph is then processed to create compact representations that can be analyzed by large language models. By employing both pure prompting and retrieval-augmented generation, the methodology enhances the mapping of observed behaviors to the MITRE ATT&CK framework, producing ranked candidates for potential adversary techniques.