RHINO: Guided Reasoning for Mapping Network Logs to Adversarial Tactics and Techniques with Large Language Models
Fanchao Meng, Jiaping Gui, Yunbo Li, Yue Wu
Modern Network Intrusion Detection Systems (NIDS) generate vast volumes of low-level alerts that remain semantically fragmented, requiring labor-intensive manual correlation with high-level adversarial behaviors. Existing automation, namely rule-based systems and machine learning classifiers, has critical limitations: rule-based approaches fail to adapt to novel attack variations, while machine learning methods lack contextual awareness and treat tactic-technique (TT) mapping as syntactic matching rather than reasoning. Although Large Language Models (LLMs) show promise in cybersecurity, preliminary experiments reveal that existing LLM-based methods frequently hallucinate technique-tactic pairs or produce decontextualized mappings due to single-step classification. We introduce RHINO, a framework that decomposes LLM-based attack analysis into three structured phases: (1) behavioral abstraction, translating raw logs into contextualized narratives; (2) partitioned inference over the ATT&CK tactic space, generating candidate techniques by evaluating behavioral evidence against MITRE ATT&CK knowledge; and (3) knowledge-grounded refinement, cross-referencing predictions with official MITRE definitions to reduce hallucinations. We evaluate RHINO on three benchmarks (DAPT2020, CICIDS2017, IoT23) across four backbone models (ChatGPT-4o, Gemini 2.5 Flash, Claude Sonnet 4, and DeepSeek V3). Under a scenario-documented single-label formulation covering 11 distinct techniques, RHINO achieves an average top-1 accuracy of 87.34% under micro-averaging and 63.77% under macro-averaging, surpassing the strongest baseline by 16.78 and 13.60 points respectively. These results show that structured LLM reasoning can effectively translate low-level network observations into high-level adversarial behaviors.
尚无 AI 解读，展示原文摘要