2026· International Conference on Security and Cryptography· pp. 852-859· 0 citations· 25 references
Computer Science
TL;DR
Graph2TTP is proposed, a novel neural-symbolic framework for automated, paragraph-level Tactic, Technique and Procedure (TTP) identification that outperforms state-of-the-art neural baselines and establishes a robust new standard for accurate and interpretable threat intelligence analysis.
Abstract
: Mapping unstructured Cyber Threat Intelligence (CTI) reports to the MITRE ATT&CK framework is critical for proactive defence but remains a manual, time-consuming process. Existing automated approaches either rely on black-box language models that lack interpretable reasoning or brittle, rule-based knowledge graphs that fail to scale. To bridge this gap, we propose Graph2TTP, a novel neural-symbolic framework for automated, paragraph-level Tactic, Technique and Procedure (TTP) identification. Graph2TTP leverages the zero-shot comprehension of Large Language Models (LLMs) to automatically extract entities and relations from extensive CTI narratives, constructing rich, localized Cyber Security Knowledge Graphs (CSKGs). We encode these symbolic structures into dense embeddings and process them via a multi-label Edge-featured Graph Attention Network (EGAT). This hybrid architecture delivers both the high-fidelity accuracy of neural networks and the transparent, verifiable reasoning paths required by security analysts. To facilitate rigorous evaluation, we curate and release APTCTI, a real-world dataset comprising 690 Advanced Persistent Threat reports spanning over 18,087 paragraphs. Extensive evaluations across multiple datasets demonstrate that Graph2TTP outperforms state-of-the-art neural baselines (e.g., CySecBERT) by approximately 20% in F1 score, establishing a robust new standard for accurate and interpretable threat intelligence analysis.
BEACON is an LLM-driven framework for cross-source CTI knowledge graph construction that constructs and releases two human-annotated datasets from 34 sources and outperforms all baselines by at least 23% and 9%, respectively.
This paper proposes an automated framework that extracts reachable attack chains by modeling each attack step as an attack unit of preconditions, an attack behavior, and postconditions, and produces attack units that are more complete and consistent than those generated by end-to-end LLM baselines.
Wenbo Hou, N. Hu, Xueping Wang et al.· arXiv.org· 0 citations
CyberNER is introduced, a two-stage pipeline to solve the multi-type NER and alias canonicalization problem in APT CTI reports and achieves a Macro-F1 score of 0.853, outperforming all four baselines.
Unnamalai K, Suriakala M· International journal of com...· 0 citations
GARAGE is introduced, a RAG-powered framework that converts fragmented CTI into an actionable, domain-specific knowledge base for automated attack graph generation and position GARAGE as a scalable TARA support tool within human-in-the-loop workflows, offering a comprehensive cost-performance analysis to guide its deployment across various LLM tiers.
Daekwon Pi, Sangho Lee, Young-Hun Lee et al.· arXiv.org· 0 citations
Security Operations Centers increasingly rely on automated mapping of Cyber Threat Intelligence reports to MITRE ATT&CK, yet extractor outputs remain fallible and are often stored without the evidence, provenance, and validation history needed to decide whether an individual mapping should be trusted. We present TRACE- CTI, a post-extraction claim-governance framework that preserves run-level Predictions, aggregates them into configuration-level GraphAssertions, materializes setup-deduplicated corroboration as ConsensusAssertions, and exposes only GraphAssertions backed by policy-compliant validation grounds. The framework retains native evidence granularity, complete extraction provenance, versioned trust decisions, and non-destructive revocation history. We evaluate TRACE-CTI on two public CTI corpora comprising 65 reports and 5,303 sentences, using a controlled 2 x 3 matrix of retrievers and generator families, incrementally ingested across six GraphVersions. All setups are incorporated without schema modification; provenance paths remain complete, operational scopes remain disjoint, and every trusted GraphAssertion has an active qualifying validation ground. Cross-generator-family setup pairs exhibit greater output diversity than same-family pairs. At the final graph state, increasing setup support from k>= 1 to six-setup unanimity raises gold-aligned precision from 25.3% to 90.6%, while recall decreases from 88.2% to 16.3%. The graph also directly answers seven questions about provenance, trust, versioning, dependency, disagreement, and review-queue that the evaluated minimal flat output cannot fully answer without enrichment or reprocessing. These results support explicit, auditable governance of extracted TTP claims; the observed corroboration trajectory is descriptive and does not establish statistical independence or a causal model-family effect.
Federico Valletta, G. Longo, E. Russo et al.· arXiv.org· 1 citation
A manually constructed dataset of 150 English-language CTI reports, each represented as STIX 2.1 based graphs, provides a benchmark for CTI information extraction, knowledge-graph construction, incident analysis, and threat attribution and indicates that locally deployed LLMs can support human reviewers in identifying annotation inconsistencies, but expert validation remains essential.
Dipshikha Das, Arnab Banik, Md. Shariful Islam et al.· arXiv.org· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
