Article

Structural Leakage in Host Intrusion Alert Corpora: An Evaluation Framework for ATT&CK Technique and Tactic Mapping

2026-08-21

Abstract excerpt

<title>Abstract</title> <p>Host-based intrusion detection alerts are abundant but often difficult to interpret as evidence of adversary behaviour. This study presents a leakage-aware workflow that maps Wazuh alert telemetry, collected in a controlled Cyber Range, to MITRE ATT&CK tactics and techniques, with a specific focus on structural data leakage in rule-generated alert corpora. Using primary alert text and m...

Topics

Open a Topic to create a Post that cites this publication.

Identifiers and source

Literature Corpus work: 06fcedee-9e1c-5bf7-80cf-23d745be2eed
DOI: 10.21203/rs.3.rs-10763135/v1

Open publication

Related research

Semantic proximity does not establish scientific evidence.

Click a neighbor to travelStep 1 · 12 closest

Structural Leakage in Host Intrusion Alert Corpora: An Evaluation Framework for ATT&CK Technique and Tactic MappingDOI 10.21203/rs.3.rs-10763135/v1Read

Functionality-preserving Adversarial Machine Learning For Robust Classification In Cybersecurity And Intrusion Detection Domains: A SurveySemantic proximity Read

Near-Deterministic Reconstruction of Enterprise Firewall Decisions for Policy Audit: Proxy Structure, Context Shift, and Residual UncertaintySemantic proximity Read

Next-Generation Cyber Defense: Transformer-Based AI for Threat Detection and Autonomous Response in Dynamic EnvironmentsSemantic proximity Read

Detection of Attacks with An Adversarial Machine Learning ApproachSemantic proximity Read

A Hybrid Explainable AI Framework for Cyber Threat Detection and ResponseSemantic proximity Read

ML-RDM: A Multi-Layered Resilient Defense Model Against Evolving Ransomware EcosystemsSemantic proximity Read

Ethical and Transparent AI in Cyber Defense: An Explainable AI Plugin for Network Intrusion Detection Using SHAP, LIME, and ELI5Semantic proximity Read

SentinelSphere: An AI-driven cybersecurity platform integrating real-time threat detection with security awareness educationSemantic proximity Read

A Dynamic Explainable AI FrameworkforReal-Time Intrusion Detection andAutomatedAlert Prioritization in Security OperationCentersSemantic proximity Read

Bridging the Gap: Advancing the Transparency and Trustworthiness of Network Intrusion Detection with Explainable AISemantic proximity Read