Adversary Brains: Hypothesis-Based Logical Signatures for Threat Actor Detection with LLMs

Summary

The article proposes an adversary brain, an LLM-based model of a threat actor's behavior held as an evolving logical signature that data can test continuously. It builds on Analysis of Competing Hypotheses (ACH), extending it from a handful of hypotheses to thousands for continuous detection, and uses language models to convert prose reports into brains, judge matches, and maintain them. A partial pattern can also surface new indicators, such as a fresh C2 domain.