Search papers, labs, and topics across Lattice.
This paper introduces Topic-Guided Consistency Modeling (TGCM), a novel framework designed to address the Unknown-K Interleaved Sequence Demixing (UKISD) problem in enterprise environments where multiple Advanced Persistent Threat (APT) campaigns overlap. By leveraging Consistency Models and incorporating topic-guided priors from MITRE ATT&CK narratives, TGCM effectively disentangles interleaved attack techniques into coherent single-campaign sequences in a single inference step. Evaluation against 15 baselines demonstrates TGCM's superior performance in separating techniques under challenging conditions, achieving robust results even in zero-shot scenarios on real-world datasets.
TGCM outperforms existing methods by effectively disentangling overlapping APT campaigns, achieving robust separation even in complex interleaved scenarios.
In enterprise environments, multiple Advanced Persistent Threat (APT) campaigns often unfold concurrently, producing audit logs in which attack techniques across actors (sources) are interleaved over time. This setting naturally gives rise to an Unknown-K Interleaved Sequence Demixing (UKISD) problem: recovering multiple latent campaigns from an interleaved technique sequence while jointly inferring their number and technique-level assignments. Existing approaches, ranging from statistical pattern mining to provenance-based analysis, typically assume single-campaign settings or rely on rigid heuristics, limiting their effectiveness under realistic conditions involving overlapping campaigns, shared techniques, and variable execution lengths. We present Topic-Guided Consistency Modeling (TGCM), a generative disentanglement framework to tackle the UKSID problem. TGCM leverages Consistency Models to learn a direct inverse mapping from interleaved multi-campaign observations to structured single-campaign sequences in a single inference step. To favor semantically coherent attack chains, TGCM incorporates a topic-guided prior derived from MITRE ATT\&CK narratives, providing high-level tactical constraints during decomposition. We evaluate TGCM on synthetic datasets, established mixed datasets, and incident traces from DARPA TC-E3 and TC-E5, comparing against 15 representative baselines spanning pattern mining, deep learning, and LLM-based methods. Results indicate improved separation robustness over baselines under heavy interleaving and technique sharing, and show that TGCM generalizes zero-shot to a naturally interleaved in-the-wild benchmark (DARPA TC-E5) without retraining.
