RHINO: Guided Reasoning for Mapping Network Logs to Adversarial Tactics and Techniques with Large Language Models

TL;DR

RHINO tackles the challenge of mapping noisy Network Intrusion Detection System logs to MITRE ATT&CK tactics and techniques by introducing a four-module, context-aware reasoning framework. Through preprocessing (log compression), abstraction (behavioral narratives), multi-role inference (partitioned TT evaluation), and refinement (MITRE-aligned validation), RHINO reduces hallucinations and improves interpretability while achieving high top-1 accuracy (approximately 86.4%–88.5%) across diverse datasets and backbone models. Ablation and error analyses show the critical role of abstraction and partitioned inference in boosting performance and reducing misclassifications. Practical validation with production-like NIDS demonstrates strong threat mapping without compromising detection, underscoring RHINO’s potential to enhance operational threat intelligence in real-world security operations centers.

Abstract

Modern Network Intrusion Detection Systems generate vast volumes of low-level alerts, yet these outputs remain semantically fragmented, requiring labor-intensive manual correlation with high-level adversarial behaviors. Existing solutions for automating this mapping-rule-based systems and machine learning classifiers-suffer from critical limitations: rule-based approaches fail to adapt to novel attack variations, while machine learning methods lack contextual awareness and treat tactic-technique mapping as a syntactic matching problem rather than a reasoning task. Although Large Language Models have shown promise in cybersecurity tasks, preliminary experiments reveal that existing LLM-based methods frequently hallucinate technique names or produce decontextualized mappings due to their single-step classification approach. To address these challenges, we introduce RHINO, a novel framework that decomposes LLM-based attack analysis into three interpretable phases mirroring human reasoning: (1) behavioral abstraction, where raw logs are translated into contextualized narratives; (2) multi-role collaborative inference, generating candidate techniques by evaluating behavioral evidence against MITRE ATT&CK knowledge; and (3) validation, cross-referencing predictions with official MITRE definitions to rectify hallucinations. RHINO bridges the semantic gap between low-level observations and adversarial intent while improving output reliability through structured reasoning. We evaluate RHINO on three benchmarks across four backbone models. RHINO achieved high accuracy, with model performance ranging from 86.38% to 88.45%, resulting in relative gains from 24.25% to 76.50% across different models. Our results demonstrate that RHINO significantly enhances the interpretability and scalability of threat analysis, offering a blueprint for deploying LLMs in operational security settings.

Figures (5)

• Figure 1: An example of attack-to-tactic/technique (TT) mapping for web server vulnerability scanning (in the DAPT2020-Tuesday dataset). The attacker probes for injection points, with traffic analyzed by a NIDS. Traditional methods (rule-based alerts, statistical keyword tables, or ML) and prior LLM-based approaches rely on alert text or rule parsing. In contrast, our method processes compressed attack context logs through LLM reasoning, enabling TT mapping without dependency on NIDS alerts or rules.
• Figure 2:
• Figure 3: Class-wise F1 scores for top-1 and top-5 predictions across two representative backbone models: Gemini 2.5 Flash (best-performing) and DeepSeek V3 (worst-performing).
• Figure 4: The top-1, top-3, and top-5 weighted accuracy rates of RHINO in mapping detected attack behaviors to techniques and tactics for the CICIDS2017 and IoT23 datasets.
• Figure 5: Cost-effectiveness analysis. Each dot's size represents the average token consumption of each method. The y-axis represents the average accuracy across three datasets.