Technique-Level Normalization for Cybersecurity Intelligence: An Empirical Evaluation of ATT&CK Attribution from HIDS Alerts Using Fine-Tuned Transformers and Metadata Re-Ranking
Year: 2026
Type: article
Abstract: Cybercrime investigations increasingly depend on the ability to interpret large volumes of automated security events. For organizations without dedicated security operations centres, a situation common among small and medium enterprises, the manual translation of raw alerts into structured threat intelligence represents a critical bottleneck that slows investigative triage and limits cross-case comparability. This paper evaluates an automated enrichment pipeline designed to address this bottleneck by mapping security events to standardised adversary behaviour labels drawn from the MITRE ATT&CK framework, supporting both operational response and cybercrime investigation workflows. We compare three pipeline configurations, a general-purpose encoder model, a cybersecurity domain-adapted variant, and a hybrid system incorporating a metadata-aware re-ranker, across 1,566 alerts from a controlled nine-stage adversarial experiment with 471 ground-truth labelled alerts spanning 12 adversary techniques, and 8,465 Windows events from an external dataset. Domain adaptation proves to be a prerequisite for operational viability where the general-purpose model assigns meaningful similarity scores to fewer than 1% of alerts, while the fine-tuned model does so for all 1,566. The hybrid system achieves 88.54% micro Top-1 accuracy and a class-balanced macro-F1 of 0.244 against a majority-class predictor of 0.182, confirming genuine multi-class benefit beyond what a trivial always-predict strategy provides. The metadata re-ranker resolves a specific ambiguity between valid-accounts and account-removal predictions, correcting 400 misattributions with zero adverse effects and 98.3% precision, a statistically significant improvement stable across all tested parameter settings.
Author: Emad Sherif
Institution: De Montfort University
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W7204229730