Automated Cyber Attack Anatomy and Timeline Visualization with Retrieval-Augmented Generation (RAG) pipeline

Visualization of Cyber attacks’ anatomy and timeline facilitates the succinct depiction of complex cyber incidents into a precise sequence of adversarial events, showing how the attack unfolded step by step over time. Such visualization is essential for security professionals to enhance situational awareness, support post-incident learning, and plan security countermeasures in their organizations. Security researchers and cybersecurity organizations often publish whitepapers on malware incidents or any other cyber attacks to share insights on emerging cyber threats, their modus operandi (i.e., tools, techniques, and practices), and potential defense strategies to demonstrate their expertise, support collaborative cybersecurity efforts, and strengthen industry-wide resilience. However, the unstructured nature of published whitepapers often requires manual interpretation to identify the attack tactics, techniques, and procedures (TTPs), which can be time-consuming for security professionals. Furthermore, the existing whitepaper reports often lack attack visualization, making it difficult for readers to quickly grasp attack patterns, infection paths, and potential impacts, which reduces their practical usability. This paper presents a solution leveraging a Retrieval-Augmented Generation (RAG) pipeline to automatically extract the Cyber attack TTPs and timeline from whitepapers and visualize them in a single diagram. The proposed solution combines semantic embeddings, local large language models (LLMs), and a structured MITRE knowledge base to ensure accurate and ordered mapping of attack stages with the official MITRE ATT&CK framework. The consolidated view of the attack anatomy and timeline makes it easier to understand its progression, identify critical attack stages, and support cybersecurity planning and deployment. The proposed solution significantly reduces the manual workload for security analysts while at the same time enhancing their ability to quickly and accurately understand adversary behavior.