Technique-Level Normalization for Cybersecurity Intelligence: An Empirical Evaluation of ATT&CK Attribution from HIDS Alerts Using Fine-Tuned Transformers and Metadata Re-Ranking

Abstract

Cybercrime investigations increasingly depend on the ability to interpret large volumes of automated security events. For organizations without dedicated security operations centres, a situation common among small and medium enterprises, the manual translation of raw alerts into structured threat intelligence represents a critical bottleneck that slows investigative triage and limits cross-case comparability. This paper evaluates an automated enrichment pipeline designed to address this bottleneck by mapping security events to standardised adversary behaviour labels drawn from the MITRE ATT&CK framework, supporting both operational response and cybercrime investigation workflows. We compare three pipeline configurations, a general-purpose encoder model, a cybersecurity domain-adapted variant, and a hybrid system incorporating a metadata-aware re-ranker, across 1,566 alerts from a controlled nine-stage adversarial experiment with 471 ground-truth labelled alerts spanning 12 adversary techniques, and 8,465 Windows events from an external dataset. Domain adaptation proves to be a prerequisite for operational viability where the general-purpose model assigns meaningful similarity scores to fewer than 1% of alerts, while the fine-tuned model does so for all 1,566. The hybrid system achieves 88.54% micro Top-1 accuracy and a class-balanced macro-F1 of 0.244 against a majority-class predictor of 0.182, confirming genuine multi-class benefit beyond what a trivial always-predict strategy provides. The metadata re-ranker resolves a specific ambiguity between valid-accounts and account-removal predictions, correcting 400 misattributions with zero adverse effects and 98.3% precision, a statistically significant improvement stable across all tested parameter settings.