🤖 AI Summary
This study addresses the unclear impact of symbolic predicate granularity on the effectiveness, computational cost, and fidelity of automated attack chain generation. For the first time, we empirically investigate this issue by translating 16 Atomic Red Team techniques into PDDL predicates at two levels of granularity—five and nine predicate classes—using large language models, followed by deterministic planning with Fast Downward. Our experiments reveal that in 81.3% of cases, different granularity schemes yield identical attack chains, indicating that planning effectiveness and computational cost are largely insensitive to predicate granularity. Instead, higher granularity primarily enhances the interpretability of internal plan structure without substantially affecting feasibility. This work delineates the practical boundaries of predicate granularity’s influence in modeling attack action linkages.
📝 Abstract
Automated attack chain generation is critical for modern cybersecurity, yet manual construction fails to scale as adversary behaviors expand. While classical AI planning using PDDL offers a formal method to automate this process, it relies on the accurate translation of techniques into symbolic predicates. Current state-of-the-art systems like AURORA employ a nine-category Attack Action Linking Model (AALM), but the necessity of this specific granularity remains unvalidated. This work investigates the impact of predicate representation granularity on plan validity, cost, and fidelity. Utilizing a pipeline where a Large Language Model (LLM) performs translation and the Fast Downward engine performs deterministic reasoning, the study compares the full nine-category AALM against a reduced five-category scheme derived empirically from Atomic Red Team (ART) execution evidence. Results from a sixteen-technique corpus demonstrate that plan validity and cost are largely insensitive to granularity, with 81.3% identical outcomes across both schemes. The findings suggest that higher granularity primarily enhances the internal structural resolution of a plan's justification rather than the viability of the generated attack chain itself.