用多模型融合与图结构预测攻击链，提升主动防御能力
KillChainGraph: ML Framework for Predicting and Mapping ATT&CK Techniques
- 分阶段建模攻击行为，用BERT和图网络捕捉攻击者路径
- 集成模型在各阶段F1最高达99.83%，优于单一GNN模型
- 适合安全研究人员和红队演练，支持可解释的攻击路径预测
日益复杂的网络攻击要求超越传统规则系统的主动检测策略。本文提出一种面向攻击链七阶段的多模型机器学习框架，基于MITRE ATT&CK Enterprise数据集模拟攻击者行为。通过ATTACK-BERT将技术语义映射到各阶段，生成七组阶段特定数据集。评估了LightGBM、自定义Transformer编码器、微调BERT及图神经网络（GNN），并采用加权软投票集成其输出。利用有向图建模阶段间依赖关系，捕获从侦察到目标达成的攻击移动路径。集成模型在各阶段均表现最优，F1分数范围为97.47%至99.83%，较GNN提升0.03%至0.20%。该图驱动的集成方法实现了可解释的攻击路径预测，强化了主动防御能力。
原文摘要 · Abstract (English)
The escalating complexity and volume of cyberattacks demand proactive detection strategies that go beyond traditional rule-based systems. This paper presents a phase-aware, multi-model machine learning framework that emulates adversarial behavior across the seven phases of the Cyber Kill Chain using the MITRE ATT&CK Enterprise dataset. Techniques are semantically mapped to phases via ATTACK-BERT, producing seven phase-specific datasets. We evaluate LightGBM, a custom Transformer encoder, fine-tuned BERT, and a Graph Neural Network (GNN), integrating their outputs through a weighted soft voting ensemble. Inter-phase dependencies are modeled using directed graphs to capture attacker movement from reconnaissance to objectives. The ensemble consistently achieved the highest scores, with F1-scores ranging from 97.47% to 99.83%, surpassing GNN performance (97.36% to 99.81%) by 0.03%--0.20% across phases. This graph-driven, ensemble-based approach enables interpretable attack path forecasting and strengthens proactive cyber defense.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。