Adversary Brains: Hypothesis-Based Logical Signatures for Threat Actor Detection with LLMs

Gadi Evron

cs.CROct 26, 2026

Adversary Brains: Hypothesis-Based Logical Signatures for Threat Actor Detection with LLMs

Authors: Gadi Evron

Organizations: Knostic

Abstract

An adversary brain is an LLM-based model of a threat actor's behavior, held as an evolving logical signature: a hypothesis with enough structure that data can test it continuously, without a person re-interpreting it each time. Rather than any single observation, such as an IoC (Indicator of Compromise), it is the arrangement that becomes a detection, or intelligence, mechanism. Where YARA matches a file and Sigma matches a log line, an adversary brain matches the activity pattern of a campaign or threat actor. This is based on an intelligence analysis technique called Analysis of Competing Hypotheses (ACH), which the design lifts from the limitation of a few hypotheses at a time, to thousands, and then also operationalizes it for continuous detection purposes. Language models make the concept, and scale, practical: they turn prose reports into brains, judge matches, and drive the loop that keeps brains current. A partial pattern in a brain can also match a new value, such as a fresh C2 (command and control) domain name, assisting with the discovery of new indicators, and turning unknown unknowns into known unknowns, and potentially into knowns. The author would like to thank Ryan Moon for the collaboration, and Sounil Yu, Chris Inglis, Thomas Roccia, Marius Benthin, Israel Grimberg, Michal Kamensky, Justin Borland, Brandon Levene, John Hultquist, and John Bambenek for their feedback and assistance.

Figures & tables

Fig. 1: Each brain catches the observations that fit its slots, single shapes are entities and a joined pair is a link, open slots wait for the rest, and whatever fits no brain falls through as noise.

Fig. 2: A behavioral clustering, where known campaigns and threat actors form labeled regions (in our case, brains), a dense unlabeled group is a candidate new brain, scattered points are noise, and new data, or incidents, are tested against all of them.

Fig. 3: State is what is: one entity, or a relation between entities. Activity is what happens: an event. Depending on whether it is provided data, or a deduction, a shared registrant can be read either way, as state or as the registration that produced it.

Fig. 4: Links compose into a brain. Solid links are the required core it cannot fire without. Dashed links are supporting. Open slots wait for what completes them.

Fig. 5: One pass, many live hypotheses: the same scoring both matches known brains and seeds unknown ones, and leaves the rest as noise. The result feeds back into the loop. Ingestion feeds the pass. Alerts, compiled rules, and shared brains leave it, and the drift and attribution judgments are not made by the loop alone.

Fig. 6: One observation, scored against brains at every scale at once. Here it matches a technique brain and a campaign brain, and passes through the actor scale, where nothing fits yet.

Fig. 7: Evidence flows only upward: raw observations pass ingest, but an alert from a detection compiled from a brain carries that brain’s id, and ingest drops it. The automated path is closed by construction. The human relay, an alert written into a report and later ingested, remains a flagged residual risk.

Fig. 8: The cheap probe: only links that both recur across related incidents and are rare in the background are worth the machinery.

Field	Type	Required	Notes
schema	string	required	Fixed: "brain/0.1"
id	string	required	UUIDv4, stable for the brain’s life
title	string	required	Max 256 chars, sentence case
status	enum	required	experimental \| test \| stable \| retired
scale	enum	required	link \| technique-set \| attack-chain \| campaign \| threat-actor
representation	enum	required	graph \| list \| chain \| centroid \| embedding

TABLE I: Brain object. Top-level document fields.

Field	Type	Required	Notes
id	string	required	Local ref, unique in file, e.g. "e1"
type	string	required	A STIX SCO type where one exists (domain-name, ipv4-addr, file, process, user-account, …), else a namespaced custom type, e.g. "x-vendor-thing"
value	string	optional	A concrete value ( "evil.example" )
pattern	map	optional	Field constraints when no concrete value, e.g. {name: "powershell.exe", command_line\|contains: "-enc"}

TABLE II: Entity object. Declared once, referenced by links.

Field	Type	Required	Notes
id	string	required	Local ref, unique in file, e.g. "L1"
type	enum	required	state \| activity
source	string	required	An entity id
target	string	required	An entity id; may equal source for an action an entity takes on itself
relation	string	required	Verb from the recommended vocabulary (shared-registrant, resolves-to, spawned, connected-to, wrote, authenticated-to, …) or a namespaced custom verb
role	enum	required	required \| supporting

TABLE III: Link object. Two entities joined by one typed relation.

Fig. 9: The worked example, drawn. Listing 2 is one serialization of this graph: entities are the nodes, links the edges, with L1 and L2 required and L3 supporting.

Cyber Threat Intelligence

Cyber threat intelligence turns evidence about adversaries, campaigns, and vulnerabilities into knowledge that helps defenders anticipate and respond to attacks.

See all 42 papers

LLMs for Zero-Shot Threat Detection via Structured Risk Indicators
Aug 17, 2026Abdullah Alghamdi, Siamak Layeghy, Marius PortmannAnomaly Detection
University of Queensland, Brisbane, Australia
Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering
Oct 6, 2026Kemal Davaslioglu, Sastry KompellaLLMs for Cybersecurity
Nexcepta, Gaithersburg, MD, USA
Cyber Defense Benchmark: Agentic Threat Hunting Evaluation for LLMs in SecOps
Apr 21, 2026Alankrit Chona, Igor Kozlov, Ambuj KumarAI Agent Security Benchmarks LLMs for Cybersecurity
Simbian AI

Aug 17, 2026J/K move · Enter open · S save

LLMs for Zero-Shot Threat Detection via Structured Risk Indicators

Abdullah Alghamdi, Siamak Layeghy, Marius Portmann

University of Queensland, Brisbane, Australia

Anomaly Detection

Open paper AskPDF arXiv

We propose a two-stage large language model (LLM) framework for zero-shot detection of insider threats and advanced persistent threats (APTs) from heterogeneous security logs. The framework models user activity as chronological timelines and incorporates retrieval-augmented generation (RAG) to provide personalised behavioural context from each user's historical activity. Rather than performing end-to-end classification directly from raw logs, it first generates structured, interpretable sets of threat-specific risk indicators, which are then classified jointly across temporal sequences to capture attack patterns spanning multiple windows.The framework is evaluated on two benchmark datasets, CERT r5.2 for insider threat detection and PicoDomain for APT detection, using four combinations of two open-weight LLMs under both retrieval and non-retrieval settings. All configurations outperform the previous state-of-the-art LLM-based framework (GABM), with the best configuration improving the F1-score by 11.40 percentage points on CERT r5.2 and 31.50 percentage points on PicoDomain. Results further show that retrieval mainly benefits weaker LLMs by generating more discriminative risk indicators, whereas stronger models achieve comparable performance without retrieved context. The most effective assignment of LLMs to the two stages depends on the dataset. These findings show that the quality of the generated risk indicators is the main driver of zero-shot cyber threat detection performance.

Abstract

Cyber Threat Intelligence

Explore similar work

LLMs for Zero-Shot Threat Detection via Structured Risk Indicators

Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering

Cyber Defense Benchmark: Agentic Threat Hunting Evaluation for LLMs in SecOps