LLM-Based Kill Chain Detection for Cookie-Based Identity Theft: A Framework Aligned with MITRE ATT&CK and OWASP Top 10:2025

Abstract

Session cookies sustain authenticated state in modern web applications; once compromised, they allow adversaries to impersonate legitimate users without requiring passwords or Multi-Factor Authentication (MFA) credentials. Although HTTPS and cookie security attributes such as Secure, HttpOnly, and SameSite are widely deployed, cookie theft remains viable through Cross-Site Scripting (XSS), Adversary-inthe-Middle (AiTM) phishing, malicious browser extensions, and HTTP integrity attacks. Existing rule-based intrusion detection systems remain limited in tracking the contextual progression of cookie theft across multiple kill chain stages. This paper proposes an LLM-based kill chain detection framework for cookie-based identity theft, structured according to the MITRE ATT&CK enterprise matrix and aligned with OWASP Top 10:2025. The framework integrates retrieval-augmented generation (RAG) over a structured knowledge base to map behavioral signals from HTTP session logs and PCAP captures to adversarial tactics, techniques, and procedures (TTPs). A behavioral prefilter suppresses only zero-signal events before LLM inference, rather than serving as a complete benign-versus-attack classifier. Evaluation on a 1,100-event simulation dataset spanning seven adversarial scenarios shows that the pre-filter skipped 650 zero-signal events, reducing LLM invocations by 59.2%. The framework achieved a precision of 0.683, recall of 1.000, F1score of 0.812, and accuracy of 0.871, with all processed attack scenarios reaching a detection rate of $\mathbf{1. 0 0 0}$. The system reports an automated mitigation-recommendation latency of 101.3 s on CPU-only hardware, interpreted as an inference-time response proxy rather than conventional operational MTTR.