Skip to content

An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

2026 · arXiv.org · Vol abs/2607.19742 · 0 citations · 39 references
Computer Science

TL;DR

This paper proposes an automated framework that extracts reachable attack chains by modeling each attack step as an attack unit of preconditions, an attack behavior, and postconditions, and produces attack units that are more complete and consistent than those generated by end-to-end LLM baselines.

View source

Similar papers

Review Open access Jul 2026

Auto Threat AI: An Agentic and Explainable Framework for Automated Cyber Threat Intelligence Extraction

Cyber Threat Intelligence (CTI) enables Security Operations Centers (SOCs) to understand adversary behavior, prioritize risks, and respond to cyber threats. However, cur-rent CTI workflows still depend heavily on manual analysis of unstructured threat reports, vulnerability advisories, open-source intelligence, social...

Methari Keeravani · 0 citations
Preprint Jul 2026

Symbolic Attack Chain Generation from Atomic Red Team Techniques: An Empirical Study of Predicate Representation Granularity

This work investigates whether AURORA's nine-category taxonomy provides representational distinctions beyond those captured by a reduced, empirically derived scheme, and suggests that higher granularity primarily enhances the internal structural resolution of a plan's justification rather than the viability of the gene...

Ramya Varunsegar · 0 citations
Conference Open access 2026

Graph2TTP: Knowledge Graph-Guided Paragraph-Level TTPs Identification from Cyber Threat Intelligence Reports

Graph2TTP is proposed, a novel neural-symbolic framework for automated, paragraph-level Tactic, Technique and Procedure (TTP) identification that outperforms state-of-the-art neural baselines and establishes a robust new standard for accurate and interpretable threat intelligence analysis.

Patrick Zounon, Yu-Fei Han, Michel Hurfin et al. · 0 citations
Jul 2026

Beyond Detection: Agentic Attack Synthesis and Simulation for Smart Contracts

This work proposes KASS (Knowledge-Augmented Attack Synthesis and Simulation), a multi-agent framework for executable smart contract exploit verification and produces structured attack plans that document exploitation flows, quantify potential asset losses, and serve as semantic false positive filters for static analys...

Xianhao Zhang, Jing Sun, Zijian Zhang et al. · 0 citations
#artificial intelligence Preprint Aug 2026

From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation

AUTOSIGMA, an automated solution for transforming unstructured CTI reports into relevant Sigma rules that enables accurate, context-aware, and relevant rule generation, outperforms alternative solutions and LLM models in rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to input quality.

Sepehr Ghaffarzadegan, Boubakr Nour, M. Pourzandi et al. · 0 citations
Preprint Jul 2026

DREA: Decoupled Reasoning and Exploration Agents for Repository-Level Vulnerability Detection

DREA (Decoupled Reasoning and Exploration Agents), a hypothesis-driven framework for repository-level vulnerability detection, improves Pair-Correctness from 19-26% to 30-42% while offloading over 93% of tokens to the explorer, reducing estimated billable API cost by a factor of 16-48.

Mingyang Sun, Guozhu Meng · 1 citation

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.