E. Sherif

Technique-Level Normalization for Cybersecurity Intelligence: An Empirical Evaluation of ATT&CK Attribution from HIDS Alerts Using Fine-Tuned Transformers and Metadata Re-Ranking

An automated enrichment pipeline designed to address this bottleneck by mapping security events to standardised adversary behaviour labels drawn from the MITRE ATT&CK framework is evaluated, supporting both operational response and cybercrime investigation workflows.