🤖 AI

Symbolic Attack Chain Generation from Atomic Red Team Techniques: An Empirical Study of Predicate Representation Granularity

This empirical study demonstrates that reducing the predicate representation granularity in automated attack chain generation from nine to five categories does not significantly impact plan validity or cost, suggesting that higher granularity primarily refines structural justification rather than the viability of the generated attack chains.

Original authors: Ramya Varunsegar

Published 2026-08-04

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ramya Varunsegar

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to teach a robot how to break into a digital fortress. You can't just tell the robot, "Go steal the treasure." You have to give it a step-by-step recipe: "First, find the back door. Second, pick the lock. Third, walk inside." In the world of cybersecurity, these recipes are called attack chains. They are the blueprints hackers use to move from a tiny entry point to a massive data heist. Defenders study these blueprints to build better alarms and traps.

To make these blueprints, scientists use a special kind of computer logic called AI planning. Think of it like a super-smart GPS for hackers. Instead of guessing, the GPS looks at all the possible moves and figures out the most efficient path to the goal. But for the GPS to work, you have to describe the world to it very precisely. You have to decide exactly what "facts" matter. Is it important that the hacker has a specific tool? Is it important that they are logged in as an admin? Or is it enough to just say "they are inside"? This is the big question: How much detail do you need to give the robot before it gets confused or makes a mistake? If you give it too little, it might plan a heist that's impossible. If you give it too much, you might be wasting time describing things that don't actually change the outcome.

This is exactly what Ramya Varunsegar's paper investigates. The author wanted to know if the current "gold standard" for describing these hacker moves was actually necessary, or if it was just being overly complicated.

The Big Experiment: Simplifying the Recipe

For a long time, the best system for teaching robots about hacking (called AURORA) used a very detailed checklist with nine different categories to describe every single move a hacker makes. It was like having a recipe book that listed not just "add salt," but "add sea salt from the Pacific," "add sea salt from the Atlantic," and "add sea salt from the Himalayas," even if the taste was the same. The researchers wondered: Do we really need all nine categories, or can we get away with fewer?

To find out, they built a testing machine. They took a collection of 16 real-world hacking techniques (from a library called Atomic Red Team) and tried to translate them into two different languages for the robot:

The original, complex nine-category language.
A new, simplified five-category language they created by watching how these hacks actually worked in real life.

They then asked a super-smart planning engine (called Fast Downward) to try and solve the puzzle using both languages. The goal was to see if the simplified version would make the robot fail, cost more time, or produce a worse plan.

The Surprising Results

The results were a bit like discovering that a high-definition 8K camera isn't always necessary to see a cat on a sofa.

Success Rate: The robot was just as successful with the simple five-category list as it was with the complex nine-category list. Both versions managed to create a valid attack plan for 13 out of the 16 techniques. That's a 81.3% success rate for both. The extra detail didn't help the robot succeed any more often.
Cost and Speed: The "cost" of the plans (how many steps the robot had to take) was exactly the same. The simplified version didn't make the robot take a longer, roundabout path.
The "Fidelity" Check: When they compared the robot's plans to a human-made "ground truth" (the perfect, expected path), the robot got a perfect score of 1.0 (a perfect match) in both cases.

The One Catch: When Detail Does Matter

However, the paper doesn't say "throw away all the details." The researchers found that the extra detail in the nine-category system mostly helped with the internal explanation of why a plan worked, rather than making the plan itself work better.

There was one specific case where the extra detail was crucial. In one technique, a hacker needed to be an "Administrator" to do something. But the robot found that just being an Administrator wasn't enough; the hacker also needed to be able to use that power over a network connection. The simplified five-category system initially missed this tiny but vital difference. The researchers had to add a specific "Environment" rule to fix it. This showed that while you can usually simplify things, you have to be careful not to glue two different things together just because they sound similar.

What This Means for the Future

The main takeaway is that for the specific set of 16 hacking techniques tested, the complex nine-category system is overkill. The simpler five-category system works just as well at generating valid attack chains.

The paper suggests that cybersecurity experts might not need to build such incredibly complex models for every situation. They can use a leaner, simpler model that is easier to manage and understand, without losing the ability to predict how hackers might strike. However, the author is careful to say this is based on a specific set of tests. They found that while the outcome was the same, the reasoning inside the robot was slightly different. The extra categories in the old system helped explain the "why" in more detail, but they didn't change the "what."

In short, the researchers found that you don't always need a microscope to see the whole picture. Sometimes, a good pair of glasses is enough to spot the intruder, provided you know exactly where to look.

Technical Summary: Symbolic Attack Chain Generation from Atomic Red Team Techniques

1. Problem Statement

Automated attack chain generation is essential for modern cybersecurity defense and red teaming, yet manual construction fails to scale as adversary behaviors expand. While classical AI planning using the Planning Domain Definition Language (PDDL) offers a formal method to automate this process, it relies on the accurate translation of adversary techniques into symbolic predicates.

Current state-of-the-art systems, such as AURORA, utilize a nine-category Attack Action Linking Model (AALM) to define system states. However, the necessity of this specific granularity remains unvalidated. It is unclear whether a reduced set of predicate categories could achieve comparable plan validity, cost, and fidelity to real attack chains, or if the higher granularity is merely an unverified design choice that increases representational complexity without improving reasoning outcomes. This paper investigates the impact of predicate representation granularity on the validity, cost, and fidelity of automatically generated attack chains.

2. Methodology

The study employs a hybrid pipeline that separates linguistic translation from deterministic reasoning to mitigate the hallucination risks associated with Large Language Models (LLMs).

2.1 Research Design

The core methodology replicates the AURORA pipeline but treats predicate granularity as an experimental variable rather than a fixed assumption.

Translation: An LLM (GPT-4.1) translates Atomic Red Team (ART) YAML test definitions and execution evidence into candidate PDDL predicates.
Validation: A deterministic, rule-based script (predicate_table.py) cross-validates LLM outputs against source YAML and execution transcripts.
Planning: The Fast Downward planner (using astar(blind())) performs all reasoning, action ordering, and plan generation.
Ablation Study: The study compares two schemes over an identical corpus of 16 formalized ART techniques:
1. Nine-Category AALM: The full scheme used by AURORA (Environments, Executors, Payloads, Files, Processes, Users, Information, Data, Techniques).
2. Five-Category Scheme: A reduced scheme derived empirically from execution evidence, collapsing categories as follows:
  - Payload $\rightarrow$ Executor
  - File and Technique $\rightarrow$ Environment
  - User and Privilege $\rightarrow$ Privilege/User
  - Information and Data $\rightarrow$ Information

2.2 Data Collection and Execution

The corpus consists of 16 techniques spanning multiple MITRE ATT&CK tactics (Discovery, Persistence, Defense Evasion, Collection, Exfiltration).

Derivation: A four-technique "starter chain" (T1059.001, T1547.001, T1003.001, T1021.002) was executed first to derive the initial five-category scheme. Crucially, execution evidence forced the inclusion of a distinct Privilege/User category (e.g., distinguishing between holding admin privileges and the ability to exercise them over a network logon).
Environment: All tests were executed in an isolated Windows 11 VM with host-only networking and active Defender to ensure realistic endpoint protection conditions without external risk.
Failure Handling: Techniques that failed to execute (e.g., due to AV/EDR blocking or missing payloads) were not discarded. Instead, they were encoded as "action-less" in the domain file, allowing the planner to correctly return "no solution" as a valid representation of empirical failure.

2.3 Evaluation Metrics

The study evaluates the schemes using:

Plan Validity/Success Rate: Whether a valid plan is generated.
Plan Cost: The number of actions in the generated plan.
Attack-Chain Fidelity: Jaccard similarity and edit distance against a manually constructed ATT&CK ground-truth chain.
Predicate Category Resolution ( $\Delta P_i$ ): A metric measuring whether the nine-category scheme forces a split in predicates that the five-category scheme collapses.
Failure-Mode Analysis: Classifying why techniques resist formalization (e.g., environmental gaps, under-specification).

3. Key Results

The empirical results from the 16-technique corpus demonstrate that predicate granularity has minimal impact on the viability of generated plans.

Plan Validity and Cost: The results were largely insensitive to granularity. Both the nine-category and five-category schemes achieved an identical success rate of 81.3% (13/16 techniques). For the nine independently solved techniques, the mean plan cost was identical (1.0). The four-step starter chain also produced identical plans in both configurations.
Attack-Chain Fidelity: The generated starter chain matched the manually constructed ground-truth chain exactly (Jaccard similarity = 1.0, edit distance = 0). The paper notes this confirms pipeline correctness but does not claim generalizable fidelity to real-world incidents, as the corpus was selected to instantiate the same narrative used to build the reference chain.
Predicate Category Resolution:
- 14 of 16 techniques showed zero resolution gain ( $\Delta P_i = 0$ ), meaning the extra granularity of the nine-category scheme did not change the structural justification of the plan.
- T1560.001 was the only genuine exception, where the nine-category scheme distinguished between Environment and File predicates that the five-category scheme collapsed.
- T1003.001 showed a resolution gain, but this was identified as an artifact of a placeholder precondition used for a technique that failed entirely, and is excluded from the claim of genuine gain.
Failure Modes: The study successfully captured systematic failures. For instance, T1055 (Process Injection) failed in 11/13 sub-tests due to AV/EDR signature detection, and T1003.001 failed due to access denial. These were encoded structurally as "no solution" rather than being papered over with placeholders.

4. Significance and Contributions

The paper modestly claims that within the scope of this specific corpus and task, a reduced five-category predicate scheme is sufficient to preserve planning capability and match the outcomes of the full nine-category AALM.

Primary Contributions:

Empirically Derived Scheme: The work provides a five-category predicate scheme derived bottom-up from real ART execution evidence, rather than adopted a priori. This derivation surfaced necessary causal distinctions (e.g., remote-admin-token-unfiltered) that an arbitrary scheme might miss.
Granularity Invariance: The study demonstrates that for the tested techniques, higher granularity primarily enhances the internal structural resolution of a plan's justification rather than the viability or cost of the generated attack chain.
Failure-Mode-as-Evidence: The paper introduces a framing where techniques that resist formalization (due to AV/EDR or missing payloads) are treated as substantive data about the limits of symbolic modeling. By encoding these as "action-less," the planner's "no solution" output becomes a verifiable statement about the corpus rather than an error.
Pipeline Architecture Validation: The work supports a bifurcated pipeline where the LLM is confined to translation and a deterministic planner handles reasoning. This architecture successfully isolated LLM hallucination risks, with a measured translation correction rate of 11.0% (89/808 predicates), which was caught by independent rule-based cross-checking before reaching the planner.

Limitations:
The author explicitly notes that the findings are specific to this 16-technique corpus and a single-VM environment. The plan cost metric had limited discriminatory power as most techniques were single-action plans. Furthermore, the exact fidelity match to the ground truth is read as evidence of pipeline correctness for the selected narrative, not as proof of generalizable fidelity to independent real-world incidents.

5. Conclusion

The study concludes that while the nine-category AALM is not incorrect, it is not strictly necessary for the validity or cost of attack chain generation in the studied context. The reduced five-category scheme preserved planning capability and matched the full scheme on every measured outcome except for one technique (T1560.001), while reducing representational complexity. The work suggests that for automated attack chain generation, the focus should be on the causal distinctions revealed by execution evidence rather than adhering to a fixed, high-granularity taxonomy.