SOURCE-LINKED INTELLIGENCE

A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

arXiv · AI, language, vision and robotics · article · Sep 11, 2026 · UTC

Mapping observed system behavior to standardized frameworks like MITRE ATT&CK is essential for threat-informed defense, but remains largely manual. Existing automated methods depend on Cyber Threat Intelligence reports, which offer only retrospective accounts of attacks. Low-level telemetry, i.e. kernel-level system calls, instead provides evidence of adversary behavior, yet its volume and complexity have limited its use for automated mapping. We present a methodology that collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph rep

Read original source ↗ Open in workspace

recordType

paper

region

Global