همایش بین المللی هوش مصنوعی

صفحه اصلی / دومین همایش بین المللی هوش مصنوعی

An Automated Modular Framework for MITRE ATT&CK Mapping

نویسندگان :

Alireza Katani¹

1- دانشگاه صنعتی اصفهان

کلمات کلیدی :

Cybersecurity،MITRE ATT&CK،LLM،SIEM

چکیده :

The significant surge in cyberattacks in recent years has placed a heavy burden on both governmental and private organizations. Security analysts are often overwhelmed with a multitude of repetitive, time-consuming tasks, many of which could be effectively automated. One of the most crucial tasks is the manual and labor-intensive process of mapping diverse security events, Security Information and Event Management (SIEM) rules, and intrusion-detection alerts to the techniques defined in the MITRE ATT&CK framework. This not only hampers analyst productivity but also compels organizations to increase staffing and absorb higher operational costs. In this study, we present an automated approach to alleviate this burden for both analysts and organizations. Our method utilizes a curated dataset consisting of attack descriptions and alerts generated by various intrusion detection tools and SIEM platforms, all of which have been labeled according to MITRE ATT&CK techniques. This dataset was used to fine-tune a lightweight large language model (LLM), enabling the development of an intelligent system capable of automatically mapping diverse cybersecurity text inputs to MITRE ATT&CK techniques.