Just Context: Interpretable ML for Root Cause and Attack Flow Discovery

No ratings

Presented at GrrCON 2025 by

Ezz Tahoun

In cybersecurity, analysts routinely drown in noisy, fragmented alerts”making it difficult to uncover coordinated, multi-stage attacks. This talk introduces an innovative approach to contextualizing alerts and extracting hidden attack chains using fully explainable, open-source machine learning”no black boxes or complex large-language models involved. Attendees will explore how clustering algorithms, temporal knowledge graphs, and Markovian sequencing methods can systematically map security alerts, logs, and telemetry to MITRE ATT&CK Techniques, clearly revealing attacker tactics and objectives. The session will include practical demonstrations using the speaker’s open-source tool, Attack Flow Detector, available on GitHub. Participants do not need deep data science expertise; basic familiarity with MITRE ATT&CK and standard SOC processes will help maximize learning outcomes. After attending, participants will understand how to implement transparent ML-based correlation workflows, reduce false positives, accelerate response times, and detect stealthy, multi-step attack flows.