TLDR: This research introduces a framework leveraging large language models (LLMs) to analyze Suricata Intrusion Detection System (IDS) logs. The goal is to infer high-level attacker actions, map them to MITRE ATT&CK techniques, and even deduce underlying cognitive biases like loss aversion or risk tolerance. By segmenting raw network telemetry into coherent behavioral phases and using a retrieval-augmented LLM for mapping, the system bridges the semantic gap between low-level network events and strategic attacker intent. While showing high precision for network-visible activities, the model’s recall is lower for host-centric or cognitively driven behaviors not directly observable in network traffic. This work paves the way for cognitive-adaptive cyber defense systems that understand not just what attackers do, but why.
Cybersecurity defense has long grappled with a significant challenge: understanding the true intent and strategic thinking of attackers from the deluge of low-level system data. Traditionally, security analysts rely on high-level intelligence reports and painstaking manual interpretation of attack sequences to piece together adversarial behavior. However, real-time defense demands a more agile approach – the ability to infer an attacker’s goals and even their cognitive strategies directly from raw system telemetry, such as intrusion detection system (IDS) logs.
A new research paper, “Security Logs to ATT&CK Insights: Leveraging LLMs for High-Level Threat Understanding and Cognitive Trait Inference”, introduces a novel framework that addresses this very challenge. The authors propose using large language models (LLMs) to analyze Suricata IDS logs and translate them into actionable insights, specifically mapping attacker actions to MITRE ATT&CK techniques. What makes this approach particularly innovative is its underlying hypothesis: attacker behavior often reflects inherent cognitive biases like loss aversion, risk tolerance, or goal persistence. By carefully observing sequences of log data, these biases can potentially be extracted and modeled.
Bridging the Semantic Gap
Traditional intrusion detection systems, like Suricata, generate fragmented and low-level event streams. They tell us “what happened” but often fail to convey the deeper meaning or connection behind these events. This creates a “semantic gap” between raw packet-level indicators and high-level attacker intent. Current methods to bridge this gap are heavily reliant on human expertise, which involves correlating alerts, hypothesizing MITRE ATT&CK techniques, and reconstructing adversarial strategies – a process that is time-consuming, prone to errors, and cognitively demanding.
The new framework aims to overcome this by directly inferring attacker actions, phases, and cognitive tendencies from IDS logs. It introduces a system that segments continuous network activity into meaningful behavioral phases. Each phase is then mapped to probable ATT&CK techniques, supported by both textual and temporal evidence. Beyond just technical mapping, the research explores how patterns such as tool switching, protocol transitions, and pivot behaviors can signal cognitive traits embedded in an attacker’s decision-making process. This builds on previous work showing that cognitive biases manifest in hacker behavior during cyber exercises.
How the Framework Works
The framework operates in two main stages:
- Action Segmentation: Suricata often produces many correlated alerts for a single user operation, leading to redundant and fragmented data. To make sense of this, an LLM is used to iteratively segment the log stream into semantically coherent “action groups.” Each new log entry is evaluated in the context of a running summary of the current group. The LLM decides if the event continues the current action or starts a new one. This process results in a chronological sequence of concise, human-interpretable action descriptions.
- MITRE ATT&CK Mapping via Retrieval-Augmented Generation (RAG-LLM): Once the log stream is condensed into atomic actions, a RAG-LLM interprets each action in terms of MITRE ATT&CK techniques. The LLM interacts with a structured knowledge base containing descriptions of all ATT&CK tactics and techniques. For each action, it retrieves relevant technique entries, compares them to the action’s description, and generates an explanation of potential matches. To maintain behavioral continuity, previous actions and inferred techniques are provided as context, allowing the model to reason about evolving attacker strategies.
Insights from Operation 418
The dataset for this study came from “Operation 418,” a controlled cybersecurity experiment where trained cybersecurity professionals acted as red-team participants, attempting to compromise a simulated enterprise network. Unlike prior studies that relied on the attackers’ self-authored operational notes (OPNOTES), this research focused exclusively on machine telemetry captured by the Suricata Intrusion Detection System. This allowed the researchers to evaluate how closely a telemetry-only model could approximate ATT&CK mappings and behavioral timelines inferred from richer, human-authored data.
The results showed that the Suricata-only model achieved high precision, meaning that when it identified an ATT&CK tactic, it usually aligned with the OPNOTES-derived label. However, recall was notably lower and more variable. This suggests that the model reliably captures what is visible on the network but cannot infer every internal decision recorded in an attacker’s notes, especially host-centric or intent-driven behaviors. For instance, tactics like Reconnaissance and Lateral Movement showed strong agreement between the Suricata-based and OPNOTES-based systems, while Persistence, Command and Control, and Exfiltration were more prevalent in the OPNOTES-derived results. Conversely, Collection behaviors, which are abundant in network traffic, appeared more frequently in Suricata-based inference.
Also Read:
- Bridging Language and Structure: A Look at Large Language Models and Text-Attributed Graphs
- NeuroGenPoisoning: A New Frontier in Understanding RAG System Vulnerabilities
Towards Cognitive-Adaptive Cyber Defense
In essence, the Suricata-based LLM demonstrates that it is indeed possible to infer high-level attacker strategies and cognitive signals directly from network telemetry alone. While there are performance gaps in categories that depend on information not fully exposed to network sensors (like credential theft or command execution within hosts), these gaps highlight the inherent limits of observability rather than a failure of reasoning. The close alignment between network-derived and OPNOTES-derived technique structures across multiple phases suggests that key elements of attacker intent can still be reconstructed from telemetry.
This work lays a strong foundation for extending cognitive inference to operational settings. Future research aims to broaden the framework’s scope by incorporating multiple data sources, such as host telemetry, authentication traces, and contextual system logs, for a more complete reconstruction of attacker operations. It also seeks to connect this work to real-time bias detection and the development of bias-aware Theory of Mind architectures capable of anticipating the behavior of adversaries. Ultimately, deploying this framework in live operational settings could enable continuous inference of attacker strategies and cognitive traits, allowing defensive systems to adapt in real-time as adversarial behavior unfolds, moving towards a new paradigm in cyber defense that reasons not only about what attackers do, but why they act as they do.
