# KillChainGraph: ML Framework for Predicting and Mapping ATT&CK Techniques

arXiv: https://arxiv.org/abs/2508.18230 · HTML: https://mlsanity.com/paper/2508.18230/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 1 of its 12 references that are in the map.
- First posted on arXiv 19 Aug 2025.

## Builds on (most cited first, 1 of 1)

- [Attacking Machine Learning models as part of a cyber kill chain](https://mlsanity.com/paper/1705.00564/) (2017)

## Abstract (arXiv)

The escalating complexity and volume of cyberattacks demand proactive detection strategies that go beyond traditional rule-based systems. This paper presents a phase-aware, multi-model machine learning framework that emulates adversarial behavior across the seven phases of the Cyber Kill Chain using the MITRE ATT&CK Enterprise dataset. Techniques are semantically mapped to phases via ATTACK-BERT, producing seven phase-specific datasets. We evaluate LightGBM, a custom Transformer encoder, fine-tuned BERT, and a Graph Neural Network (GNN), integrating their outputs through a weighted soft voting ensemble. Inter-phase dependencies are modeled using directed graphs to capture attacker movement from reconnaissance to objectives. The ensemble consistently achieved the highest scores, with F1-scores ranging from 97.47% to 99.83%, surpassing GNN performance (97.36% to 99.81%) by 0.03%--0.20% across phases. This graph-driven, ensemble-based approach enables interpretable attack path forecasting and strengthens proactive cyber defense.