Security Logs to ATT&CK Insights: Leveraging LLMs for High-Level Threat Understanding and Cognitive Trait Inference | Soham Hans et al. | ResearchPod

Transcript: Security Logs to ATT&CK Insights: Leveraging LLMs for High-Level Threat Understanding and Cognitive Trait Inference

Alex: Welcome to another episode of ResearchPod. Today we're looking at a framework that tries to bridge the gap between raw network telemetry and high-level adversarial intent.

Sam: The core problem is that security tools like Suricata generate fragmented, low-level logs that tell you what happened, but offer no insight into why an attacker is acting that way. This paper proposes using large language models to reconstruct an attacker's cognitive fingerprint directly from those logs.

Alex: So the paper is asking whether we can infer high-level psychological traits—risk tolerance, persistence, adaptability—without needing the attacker to have written down their own operational notes?

Sam: Exactly. The authors are testing whether packet-level metadata, mapped through the MITRE ATT&CK framework, can support a coherent narrative of an attacker's strategy. The goal is to turn passive network logs into something closer to a psychological profile.

Alex: That's a significant reframing. How does the model actually get from fragmented log entries to a coherent story?

Sam: They use a two-stage process they call hierarchical behavioral segmentation. Think of it like a film editor working with thousands of raw, out-of-order clips. The model acts as a sliding-window processor, evaluating whether each new log entry continues an existing action sequence or initiates a new one. It's grouping the noise into meaningful behavioral chunks before attempting any interpretation.

Alex: So the segmentation step is doing real epistemic work—it's not just preprocessing, it's actually defining what counts as a discrete attacker action.

Sam: Right, and that framing matters for what comes next. Once those chunks are defined, the system uses a retrieval-augmented generation approach to map them to specific ATT&CK techniques. The model retrieves relevant tactical descriptions to ground its interpretation, which creates a principled bridge between raw packet metadata and strategic intent—rather than just prompting an LLM and hoping it generalizes correctly.

Alex: How well does that actually hold up? There's a meaningful difference between reading an attacker's own operational notes and inferring intent from network traffic alone.

Sam: That's the critical comparison the authors make. They benchmarked against a baseline that did have access to human-authored notes. The headline result is high precision—when the model flags a behavior, it's usually correct. But the recall tells a more complicated story.

Alex: Where does it fall down?

Sam: Later-stage attack phases. The authors call it the observability ceiling. The model is essentially blind to host-resident actions—credential dumping, local privilege escalation, in-memory persistence—because those don't produce distinct network-layer signatures. The evidence lives inside the host, not on the wire.

Security Logs to ATT&CK Insights: Leveraging LLMs for High-Level Threat Understanding and Cognitive Trait Inference

Soham Hans, Stacy Marsella, Sofia Hirschmann, Nikolos Gurney

Sep 7, 2026·5:24·user_upload

Large Language Models (LLMs)MITRE ATT&CKCognitive CyberpsychologyIntrusion Detection Systems (IDS)Cognitive-Adaptive Cyber Defense

Listen

5 min

Briefing

Research Question

Traditional cybersecurity defense relies on manual interpretation of fragmented, low-level network logs to understand attacker intent. This study investigates whether Large Language Models (LLMs) can bridge the semantic gap between raw network telemetry (Suricata IDS logs) and high-level adversarial strategy, as defined by the MITRE ATT&CK framework, to enable cognitive-adaptive cyber defense.

Approach

The authors propose a two-stage framework. First, they use an LLM to perform 'action segmentation,' grouping continuous, fragmented log entries into semantically coherent behavioral units. Second, they employ a Retrieval-Augmented Generation (RAG-LLM) system to map these segmented actions to specific MITRE ATT&CK techniques. The researchers benchmarked this telemetry-only approach against a baseline that utilized 'OPNOTES'—real-time journals written by attackers—to determine how well machine-only data can approximate the accuracy of human-authored accounts.

Main Findings

The study demonstrates that LLMs can effectively reconstruct the structure of an attack from network logs alone. The model achieved high precision in identifying ATT&CK tactics that have clear network-layer signatures, such as reconnaissance and collection. However, the model showed lower recall for host-resident or internal activities, such as persistence or command-and-control, which are less visible on the wire. The results suggest that while telemetry-driven inference cannot capture every internal decision, it is highly effective at identifying the behavioral phases and shifts that signal an attacker's strategic intent.

Why It Matters

This research provides a pathway for automating threat intelligence in operational environments where human-authored notes are unavailable. By enabling systems to infer not just 'what' an attacker is doing, but the underlying strategic phases, this framework supports the development of cognitive-adaptive defenses that can anticipate adversarial moves based on observed behavioral patterns.

Key Terms and Definitions

Action Segmentation — The process of grouping raw, fragmented log entries into semantically coherent units that represent a single operator decision or system interaction.
MITRE ATT&CK — A globally accessible knowledge base of adversary tactics and techniques based on real-world observations.
Semantic Gap — The disconnect between low-level, machine-generated telemetry and the high-level, human-interpretable strategic intent behind those events.
Suricata — An open-source network threat detection engine used to monitor traffic and generate alerts, flow records, and protocol metadata.
Cognitive-Adaptive Defense — A security paradigm where defensive systems infer the human reasoning and cognitive traits behind adversarial behavior to adapt their responses in real time.

Security Logs to ATT&CK Insights: Leveraging LLMs for High-Level Threat Understanding and Cognitive Trait Inference: Research Paper Podcast