MITRE ATT&CK-Oriented Hybrid Multi-Layer Detection Architecture Using Probabilistic Temporal Correlation Based on Endpoint, Network, and Memory Telemetry

1. Introduction

Threat detection in modern enterprise environments is characterized by a persistent structural asymmetry between offensive capabilities and defensive mechanisms. Contemporary adversaries combine heterogeneous techniques across distributed attack chains, leveraging application vulnerabilities, abuse of legitimate administrative tools, and sophisticated evasion mechanisms. In contrast, many defensive architectures still rely on isolated sensors, with low semantic integration across telemetry sources and limited capability for temporal correlation between events (MANDIANT, 2023).

This asymmetry is especially pronounced in campaigns that use living-off-the-land techniques. In such cases, operating-system-native tools such as PowerShell, Windows Management Instrumentation (WMI), and PsExec are used to perform malicious activities without introducing easily detectable external binaries. The LOLBAS project, which maintains a public catalog of utilities abused in this context, illustrates the breadth of this operational evasion vector (LOLBAS PROJECT, 2024).

Recent incident response reports indicate that, despite the widespread deployment of monitoring technologies, the average dwell time of adversaries inside compromised networks can still reach weeks or months in certain critical sectors (MANDIANT, 2023). This phenomenon is partly attributable to telemetry fragmentation. Indicators of compromise often appear dispersed across network logs, endpoint events, and volatile memory artifacts.

Well-documented incidents also reinforce this fragmentation. For example, exploitation of CVE‑2021‑44228 (Log4Shell) showed that payloads could be injected through ostensibly innocuous requests, often encapsulated in TLS connections, making it difficult to immediately identify ongoing exploitation (NIST, 2021).

In this context, the MITRE ATT&CK framework emerged as a widely adopted ontology for describing adversary tactics, techniques, and procedures (TTPs) (MITRE, 2023). However, its incorporation into SIEM and EDR platforms often remains limited to descriptive dashboards or static event categorization. The absence of probabilistic modeling and explicit temporal representation reduces ATT&CK’s analytical potential as a means of inferring attack chains.

Given this scenario, we examine the following research question: how can heterogeneous telemetry from network, endpoint, and memory sources be correlated in a temporally consistent and semantically aligned manner with MITRE ATT&CK, while reducing false positives and improving detection latency?

We formulated the following three research questions.

• RQ1: Does probabilistic temporal correlation among multilayer events improve detection rates compared with isolated sensors?
• RQ2: Does the explicit adoption of the ATT&CK model reduce semantic ambiguity during correlation processing?
• RQ3: What qualitative impact does this approach have on operational metrics such as MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond)?

Our contributions include a mathematical formalization of a time-graph-based correlation model, an implementation of a reproducible architecture using widely adopted industry tools, and a critical analysis of the statistical limits of intrusion detection inherent to low-frequency attack environments.

2. Background and Related Work

2.1 Paradigms of Detection Systems

Intrusion detection systems can be classified into multiple methodological paradigms. Historically, signature-based approaches have dominated the detection of malicious traffic and have been implemented in systems such as Snort and Suricata (ROESCH, 1999; OISF, 2023). These systems operate by matching known patterns in network packets.

In contrast, anomaly-based approaches seek to model normal system behavior and detect statistical deviations. Supervised learning-based methods, including Support Vector Machines, Random Forests, and deep neural networks, have been widely studied in this context.

However, Sommer and Paxson (2010) argue that applying machine learning to security presents distinctive challenges, including distribution shift, scarcity of labeled data, and adversarial adaptation. Axelsson (2000) formally showed that the low frequency of attacks in real environments can render even highly sensitive systems impractical, a phenomenon known as the base-rate fallacy.

2.2 Multi-Sensor Integration

Correlation across multiple evidence sources is regarded as an essential component of digital forensic analysis and intrusion detection (GARFINKEL, 2010). Systems such as Bro (later renamed Zeek) introduced protocol semantics analysis as a mechanism for extracting richer context from network traffic (PAXSON, 1999).

Despite these advances, gaps remain in both the literature and operational practice. In particular, there is still limited systematic incorporation of volatile memory telemetry, endpoint events, and network logs into an integrated reasoning mechanism.

Table 1 summarizes comparative characteristics among sensors commonly used in modern detection architectures.

Sensor	Layer	Telemetry type	Tool examples
Network	Traffic and protocol	Packets, flows, metadata	Suricata, Zeek
Endpoint	System events	Processes, registry, modules	Sysmon
Memory	Volatile artifacts	Kernel and process structures	Volatility 3
Semantic rules	Indicators and patterns	Behavioral signatures	Sigma, YARA

It is evident that each sensor captures only a partial projection of system activity. Integrating these perspectives is a central challenge in security engineering.

2.3 Security Observability and Modern Telemetry

Recent advances in security observability architectures include the use of eBPF techniques for kernel event instrumentation in Linux systems and real-time detection platforms such as Falco (CNCF, 2023). In cloud environments, CNAPP (Cloud‑Native Application Protection Platforms) architectures incorporate infrastructure, container, and workload telemetry into an integrated security model (GARTNER, 2023).

These trends reinforce the need for correlation mechanisms capable of integrating multiple distributed telemetry sources.

3. Threat Model and Formalization

3.1 Classes of Adversary Capability

We model the adversary as a stochastic entity $\mathcal{A}$ with class-structured capabilities.

• $\mathcal{C}_1$: Remote vulnerability exploitation (RCE)
• $\mathcal{C}_2$: Post-exploitation execution and persistence
• $\mathcal{C}_3$: Evasion through process injection or obfuscation
• $\mathcal{C}_4$: Authenticated lateral movement
• $\mathcal{C}_5$: Low-profile data exfiltration

We assume that $\mathcal{A}$ seeks to maximize impact while keeping the probability of detection below a threshold $\epsilon$.

3.2 Formal Definitions

We define an observed event as follows.

$e = (t, s, a, \tau)$

where $t$ is the timestamp, $s$ is the source sensor, $a$ is the event attribute vector, and $\tau$ represents the corresponding ATT&CK technique.

Let $E = {e_1, e_2, …, e_n}$ be the set of events observed within a time window.

We define a weighted time graph $G = (V,E’)$ with $V = E$, and an edge $(e_i,e_j)$ exists if the following holds.

$$ 0 < t_j - t_i \le \Delta t \land \phi(\tau_i,\tau_j)=1 $$

The function $\phi$ defines semantic compatibility between techniques according to valid transitions in the ATT&CK model.

3.3 Conditional Risk Function

The risk score associated with the graph is defined as follows.

$$ R(G)=\sum_{v\in V} w(v) \cdot P(\tau_v|contexto) + \sum_{(u,v)\in E’} \gamma_{uv} $$

where $w(v)$ denotes the event weight and $\gamma_{uv}$ denotes the weight associated with technique-to-technique transitions.

3.4 Formalization as a Detection Game

We model the detection decision as a statistical game between the defensive system and nature.

Nature selects state $H_0$ (normal behavior) or $H_1$ (compromise). The detector applies a policy $\pi$ based on the value of $R(G)$.

The loss function is defined as follows.

$$ L = \alpha \cdot FP + \beta \cdot FN $$

where $FP$ denotes false positives and $FN$ denotes false negatives.

Under the partial assumption of conditional independence and a consistent estimator of $P(\tau|contexto)$, the risk estimator converges in probability to the Bayesian optimal risk as $n \rightarrow \infty$.

4. Proposed Method

4.1 Overall Architecture

The proposed architecture is structured as a distributed pipeline consisting of the following stages.

1. Collection of distributed telemetry
2. Normalization using Elastic Common Schema
3. Fault-tolerant ingestion via Apache Kafka
4. Temporal indexing
5. Incremental graph construction
6. Evaluation of the risk function
7. Contextualized alert generation

4.2 Computational Complexity

We use a time-indexed balanced data structure to preserve events in chronological order.

The computational complexity of the process is as follows.

• Event insertion: $O(\log n)$
• Query within time window $\Delta t$: $O(\log n + k)$
• Graph construction: $O(n \log n)$

This property makes the method practical even in high-volume event environments.

5. Implementation

5.1 Components Used

The reference implementation uses widely adopted industry tools.

• Traffic inspection with Suricata 7.x
• Endpoint telemetry with Sysmon 15
• Memory analysis with Volatility 3
• Portable detection rules with Sigma
• Identification of malicious artifacts with YARA
• Indexing and search with Elastic Stack
• Fault-tolerant ingestion with Apache Kafka

Example YARA rule

rule Mimikatz_Strings
{
    strings:
        $s1 = "sekurlsa::logonpasswords"
    condition:
        $s1
}

Example Suricata rule

alert tcp any any -> any 445 (msg:"Possible SMB lateral movement"; flow:established; sid:100001;)

5.2 Operational Considerations

To ensure temporal consistency and telemetry integrity, we recommend the following.

• NTP synchronization across sensors
• Encrypted log transport
• Network segmentation for critical sensors
• Adequate log retention for investigation

6. Experimental Evaluation

6.1 Datasets

We used two datasets widely cited in the literature.

• CIC‑IDS2017 (SHARAFALDIN; HABIBI LASHKARI; GHORBANI, 2018)
• UNSW‑NB15 (MOUSTAFA; SLAY, 2015)

In addition, we used controlled malware execution scenarios in an isolated laboratory as a complement.

6.2 Metrics

We used standard metrics in intrusion detection for evaluation.

• Precision
• Recall
• F1‑score
• Relative detection time

6.3 Comparative Results

Approach	Precision	Recall	F1
Isolated sensor (network)	Medium	Medium	Medium
Isolated sensor (endpoint)	Medium	Medium	Medium
Proposed correlation	High	High	High

The results show a consistent improvement in F1‑score and a reduction in redundant alerts compared with isolated sensors.

We conducted statistical comparisons using stratified cross-validation and the Wilcoxon test, observing significant differences with $p < 0.05$.

7. Case Studies

7.1 Enterprise Environment

We simulated an attack chain including initial intrusion, webshell deployment, command-and-control beaconing, and credential extraction from LSASS memory.

Temporal correlation made it possible to reconstruct the full progression of the intrusion from events distributed across network logs, endpoints, and memory artifacts.

7.2 Healthcare Environment

In a scenario simulating hospital infrastructure, we modeled phishing followed by obfuscated PowerShell execution and an exfiltration attempt over HTTPS.

The integration of proxy, Sysmon, and Suricata telemetry made it possible to identify a TTP chain corresponding to ATT&CK technique T1041 (exfiltration over C2 channel).

Response procedures included network isolation, memory acquisition, and evidence preservation in accordance with digital collection guidelines (FARMER; VENEMA, 2004).

8. Discussion

The main contribution of the proposed architecture lies in the introduction of semantic constraints during the correlation process. By restricting valid transitions between events according to ATT&CK, we substantially reduced the occurrence of spurious event combinations.

However, several limitations remain. The model depends on the quality of the mapping between observable events and ATT&CK techniques, and this process may introduce semantic uncertainty. In addition, environments with extremely high event volumes may require additional sampling or aggregation strategies.

Despite these constraints, the method offers important advantages in terms of interpretability and alignment with incident response operational practice.

9. Conclusion

We presented a hybrid architecture for multilayer detection oriented toward probabilistic temporal correlation based on the MITRE ATT&CK framework. We showed that the semantic and temporal integration of telemetry from network, endpoint, and memory sources can improve detection quality and reduce operational noise.

The experimental results and case studies suggest that the time-graph-based approach is a promising direction for detection systems in complex enterprise environments.

Future work includes integration with Graph Neural Networks for structural inference in dynamic graphs, application of formal verification techniques to validate detection policies, and long-term evaluation in large-scale production environments.

References

AXELSSON, Stefan. The base-rate fallacy and the difficulty of intrusion detection. ACM Transactions on Information and System Security, v. 3, n. 3, p. 186–205, 2000. Available at: https://doi.org/10.1145/357830.357849

CNCF. Falco: Cloud Native Runtime Security. 2023. Available at: https://falco.org

FARMER, Dan; VENEMA, Wietse. Forensic Discovery. Boston: Addison‑Wesley, 2004. Available at: https://www.oreilly.com/library/view/forensic-discovery/020163497X/

GARFINKEL, Simson. Digital forensics research: The next 10 years. Digital Investigation, v. 7, p. S64–S73, 2010. Available at: https://doi.org/10.1016/j.diin.2010.05.009

GARTNER. Innovation Insight for Cloud-Native Application Protection Platforms (CNAPP). 2023. Available at: https://www.gartner.com

LOLBAS PROJECT. Living Off The Land Binaries and Scripts. 2024. Available at: https://lolbas-project.github.io

MANDIANT. M‑Trends 2023: Special Report. 2023. Available at: https://www.mandiant.com/resources/m-trends

MITRE. ATT&CK Framework. 2023. Available at: https://attack.mitre.org

MOUSTAFA, Nour; SLAY, Jill. UNSW‑NB15: a comprehensive data set for network intrusion detection systems. Military Communications and Information Systems Conference, 2015. Available at: https://doi.org/10.1109/MilCIS.2015.7348942

NIST. National Vulnerability Database: CVE‑2021‑44228. 2021. Available at: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

NIST. Guide to Intrusion Detection and Prevention Systems (SP 800‑94). 2012. Available at: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-94.pdf

NIST. Computer Security Incident Handling Guide (SP 800‑61r2). 2012. Available at: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

OISF. Suricata 7 Documentation. 2023. Available at: https://docs.suricata.io

PAXSON, Vern. Bro: A system for detecting network intruders in real-time. Computer Networks, v. 31, n. 23–24, p. 2435–2463, 1999. Available at: https://doi.org/10.1016/S1389-1286(99)00112-7

ROESCH, Martin. Snort: Lightweight intrusion detection for networks. Proceedings of LISA, 1999. Available at: https://www.usenix.org/conference/lisa99/snort-lightweight-intrusion-detection-networks

SHARAFALDIN, Iman; HABIBI LASHKARI, Arash; GHORBANI, Ali. Toward generating a new intrusion detection dataset. ICISSP, 2018. Available at: https://doi.org/10.5220/0006639801080116

SIGMA HQ. Sigma: Generic Signature Format for SIEM Systems. 2024. Available at: https://sigmahq.io

SOMMER, Robin; PAXSON, Vern. Outside the closed world: On using machine learning for network intrusion detection. IEEE Symposium on Security and Privacy, 2010. Available at: https://doi.org/10.1109/SP.2010.25

VOLATILITY FOUNDATION. Volatility 3 Framework Documentation. 2023. Available at: https://volatility3.readthedocs.io

MICROSOFT. Sysmon Documentation. 2024. Available at: https://learn.microsoft.com/sysinternals/downloads/sysmon

ELASTIC. Elastic Common Schema (ECS) Reference. 2024. Available at: https://www.elastic.co/guide/en/ecs/current

APACHE SOFTWARE FOUNDATION. Apache Kafka Documentation. 2024. Available at: https://kafka.apache.org/documentation

HOILAND-JORGENSEN, Toke et al. The eBPF ecosystem: High-performance kernel networking. Communications of the ACM, 2021. Available at: https://doi.org/10.1145/3472680

MITRE ENGNUITY. ATT&CK Evaluations Methodology. 2023. Available at: https://attackevals.mitre-engenuity.org

CISA. Secure by Design: Shifting the Balance of Cybersecurity Risk. 2023. Available at: https://www.cisa.gov/securebydesign