LATIDIA · Ciberseguridad

RHINO: Razonamiento guiado para mapear registros de red a tácticas y técnicas adversarias con modelos de lenguaje extensos.

arXiv:2510.14233v2 Anuncio Tipo: reemplazar Resumen: Los sistemas modernos de detección de intrusiones en la red (NIDS) generan grandes volúmenes de alertas de bajo nivel que permanecen semánticamente fragmentadas, lo que requiere una correlación manual intensiva en trabajo.

La noticia

arXiv:2510.14233v2 Announce Type: replace Abstract: Modern Network Intrusion Detection Systems (NIDS) generate vast volumes of low-level alerts that remain semantically fragmented, requiring labor-intensive manual correlation with high-level adversarial behaviors. Existing automation, namely rule-based systems and machine learning classifiers, has critical limitations: rule-based approaches fail to adapt to novel attack variations, while machine learning methods lack contextual awareness and treat tactic-technique (TT) mapping as syntactic matching rather than reasoning. Although Large Language Models (LLMs) show promise in cybersecurity, preliminary experiments reveal that existing LLM-based methods frequently hallucinate technique-tactic pairs or produce decontextualized mappings due to single-step classification. We introduce RHINO, a framework that decomposes LLM-based attack analysis into three structured phases: