LATIDIA · Ciberseguridad

MEvince: Razonamiento de LLM restringido por el conocimiento para la identificación de técnicas a partir de informes de malware

arXiv:2611.07486v1 Anuncio Tipo: nuevo Resumen: El mapeo de la inteligencia conductual en los informes de análisis de malware a las técnicas ATT&CK respalda el análisis y la defensa contra amenazas, pero la identificación confiable sigue siendo un desafío. Supp

La noticia

arXiv:2611.07486v1 Announce Type: new Abstract: Mapping behavioral intelligence in malware analysis reports to ATT&CK techniques supports threat analysis and defense, but reliable identification remains challenging. Supporting evidence is often scattered across long, heterogeneous reports, while closely related techniques share behavioral cues and differ only in subtle but decisive details. While large language models (LLMs) can use external knowledge to interpret reports, they may assign techniques based on plausible associations rather than sufficient evidence. We present MEvince, a knowledge-constrained LLM reasoning framework for report-level malware technique identification. Its core is a shared behavioral representation connecting report observations to technique definitions. This representation is built through agentic mining of technique documentation and