Technique-Level Normalization for Cybersecurity Intelligence: An Empirical Evaluation of ATT&CK Attribution from HIDS Alerts Using Fine-Tuned Transformers and Metadata Re-Ranking

Authors

• Emad Sherif, De Montfort UniversityFollow

Abstract

Cybercrime investigations increasingly depend on the ability to interpret large volumes of automated security events. For organizations without dedicated security operations centres, a situation common among small and medium enterprises, the manual translation of raw alerts into structured threat intelligence represents a critical bottleneck that slows investigative triage and limits cross-case comparability. This paper evaluates an automated enrichment pipeline designed to address this bottleneck by mapping security events to standardised adversary behaviour labels drawn from the MITRE ATT&CK framework, supporting both operational response and cybercrime investigation workflows. We compare three pipeline configurations, a general-purpose encoder model, a cybersecurity domain-adapted variant, and a hybrid system incorporating a metadata-aware re-ranker, across 1,566 alerts from a controlled nine-stage adversarial experiment with 471 ground-truth labelled alerts spanning 12 adversary techniques, and 8,465 Windows events from an external dataset. Domain adaptation proves to be a prerequisite for operational viability where the general-purpose model assigns meaningful similarity scores to fewer than 1% of alerts, while the fine-tuned model does so for all 1,566. The hybrid system achieves 88.54% micro Top-1 accuracy and a class-balanced macro-F1 of 0.244 against a majority-class predictor of 0.182, confirming genuine multi-class benefit beyond what a trivial always-predict strategy provides. The metadata re-ranker resolves a specific ambiguity between valid-accounts and account-removal predictions, correcting 400 misattributions with zero adverse effects and 98.3% precision, a statistically significant improvement stable across all tested parameter settings.

Note on the Author(s)

Emad Sherif, is a Cyber Systems Engineer, and a PhD student at De Montfort University, UK. He obtained his Master of Science in Information Management and Security from Bedfordshire University, UK. Emad worked as an IT Security Team Lead for a Bank. His research interests focus on the use of data science to improve cyber security risk management.

Recommended Citation

Sherif, E. (2026). Technique-Level Normalization for Cybersecurity Intelligence: An Empirical Evaluation of ATT&CK Attribution from HIDS Alerts Using Fine-Tuned Transformers and Metadata Re-Ranking . International Journal of Cybersecurity Intelligence & Cybercrime, 9(2), - . DOI: https://doi.org/10.52306/2578-3289.1233
Available at: https://vc.bridgew.edu/ijcic/vol9/iss2/5

Copyright © 2026 Emad Sherif