In the digital world, security teams are constantly bombarded with streams of data from computers and servers. These logs record every action a machine takes: a file opening, a program starting, a connection being made. For years, the goal of cybersecurity has been to piece these scattered notes together to see the bigger picture of an attack. The challenge is that the notes are often incomplete. Attackers are skilled at hiding their tracks, deleting logs, or scrambling the order of events. Furthermore, a single computer action can mean many different things depending on the context; a program starting could be a harmless update or the beginning of a theft. Traditional methods try to solve this by matching specific patterns to known threats, but they often fail when the evidence is messy or when attackers use familiar tools in new, unexpected ways.

A team of researchers at Gachon University in South Korea has proposed a new way to think about this problem. They call their system SCOPE. Instead of trying to force every single log entry into a rigid box, SCOPE treats the analysis as a process of reasoning under uncertainty. It accepts that the data it receives is flawed and incomplete, and it builds a model that can handle missing pieces without falling apart. The researchers tested their system against a set of thirty-five known attack scenarios where the true sequence of events was already documented. They found that SCOPE could reconstruct the overall path of an attack with much higher accuracy than existing methods, even when half of the digital evidence was missing. More importantly, the system could identify complex attack patterns it had never seen before, provided those patterns were made of known building blocks arranged in a new order.

The core difficulty in analyzing these logs is that individual events are too small to tell a story on their own. A single log entry might show a file being created, but it does not explain why. To solve this, the researchers first group related events together into larger, meaningful chunks. They look for events that happen close together in time, involve the same computer processes, or touch the same files and network connections. This creates a "behavior group" that represents a coherent step in an attack, such as a hacker trying to steal passwords, rather than just a list of isolated file changes. This grouping is designed to be robust; if some events in the middle are missing or deleted, the system can still recognize the group because the remaining pieces are linked by their shared context.

Once these groups are formed, the system faces the next challenge: deciding what each group actually represents. In the past, systems would try to assign a single label to a group, like "Password Theft." If that label was wrong, the entire analysis would break. SCOPE avoids this trap by keeping multiple possibilities open at once. For each behavior group, it generates a list of potential labels with different levels of likelihood. It does not force a final decision immediately. Instead, it holds these options in a state of uncertainty, allowing the system to consider the whole picture before settling on an answer. This approach acknowledges that the same action might look like different things depending on what happens next.

The final step is to connect these groups into a complete chain. The researchers use a method that scores how well one behavior follows another based on two main factors: the logical flow of an attack and the physical connection between them. They know that certain types of actions usually happen in a specific order, like gaining access to a system before stealing data. They also look for physical links, such as a file created in one step being used in the next. By combining these logical and physical clues, the system can fill in the gaps where evidence is missing. If a step is missing, the system does not stop; it simply connects the surviving steps, acknowledging that the jump is larger than usual but still possible. This allows the system to reconstruct a continuous story even when parts of the timeline have been erased.

The researchers tested this approach using a dataset of thirty-five attack scenarios that included ground-truth records of exactly what happened. They compared SCOPE against several other leading methods, including rule-based systems that look for specific patterns, graph-based systems that map connections, and systems that use large language models to guess the story. SCOPE outperformed all of them. It correctly identified the specific techniques used in the attacks about 84% of the time when looking at the top five guesses. When measuring how well it reconstructed the entire sequence of events, it achieved a score of 0.68, which was significantly higher than the next best method.

Perhaps the most significant finding was how the system handled missing data. The researchers simulated a situation where up to 50% of the log events were randomly removed, mimicking a scenario where an attacker successfully deleted their tracks. While the performance of other systems dropped sharply as data disappeared, SCOPE remained stable. Even with half the evidence gone, it maintained a reconstruction score of roughly 0.57, which was still higher than the best score achieved by any other method when all the data was present. This suggests that the system's ability to reason about uncertainty and link surviving pieces of evidence makes it far more resilient to real-world data loss.

The system also demonstrated an ability to recognize novel attack combinations. In cybersecurity, attackers often take known tools and use them in new ways. Traditional systems often fail here because they are trained only on specific, known sequences. SCOPE, however, does not rely on memorizing specific sequences. Instead, it understands the compatibility of different attack steps. In the tests, it successfully reconstructed coherent chains of known techniques that had never appeared together in the training data. It achieved a "coherent-novel" rate of 0.83, meaning it could correctly identify and link these new combinations in 83% of the cases where they occurred. This indicates that the system can generalize its knowledge to unseen threats, provided the individual components are familiar.

A key design choice in SCOPE is how it uses artificial intelligence. The researchers used a large language model, a type of AI capable of understanding natural language, but only for one specific task: describing the behavior groups in plain text. The model does not make the final decisions about what the attack is or how the pieces fit together. Those decisions are made by a deterministic, mathematical process that scores the connections between steps. This separation ensures that the system does not "hallucinate" or invent details that are not supported by the data. The language model acts only as a translator, turning raw computer logs into a description that the scoring system can understand, while the scoring system remains the strict judge of the final chain.

The researchers acknowledge that their work is based on a controlled dataset and that real-world enterprise environments are much more complex. They note that their system is not a replacement for low-level detection triggers but rather a tool for making sense of the data that those triggers produce. The system is designed to work with the incomplete and noisy nature of real logs, offering a way to recover the narrative of an attack even when the evidence is fragmented. By treating attack analysis as a problem of reasoning under uncertainty rather than simple pattern matching, the researchers have created a framework that is more robust to the tricks attackers use to hide their tracks. The results suggest that the future of attack analysis may lie not in finding more data, but in reasoning more effectively with the data that remains.