mlsanityData to 7 Oct 2026

Actionable Cyber Threat Intelligence using Knowledge Graphs and Large Language Models

arXiv 2407.02528 ↗First posted 30 Jun 2024cs.CR cs.AI cs.CLcited by 14

Not on the map. Why?

Abstract (arXiv)

Cyber threats are constantly evolving. Extracting actionable insights from unstructured Cyber Threat Intelligence (CTI) data is essential to guide cybersecurity decisions. Increasingly, organizations like Microsoft, Trend Micro, and CrowdStrike are using generative AI to facilitate CTI extraction. This paper addresses the challenge of automating the extraction of actionable CTI using advancements in Large Language Models (LLMs) and Knowledge Graphs (KGs). We explore the application of state-of-the-art open-source LLMs, including the Llama 2 series, Mistral 7B Instruct, and Zephyr for extracting meaningful triples from CTI texts. Our methodology evaluates techniques such as prompt engineering, the guidance framework, and fine-tuning to optimize information extraction and structuring. The extracted data is then utilized to construct a KG, offering a structured and queryable representation of threat intelligence. Experimental results demonstrate the effectiveness of our approach in extracting relevant information, with guidance and fine-tuning showing superior performance over prompt engineering. However, while our methods prove effective in small-scale tests, applying LLMs to large-scale data for KG construction and Link Prediction presents ongoing challenges.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Builds on 31 of its 62 references that are in the map. First posted on arXiv 30 Jun 2024.

Builds on

31 of 62 references.

References · 31

  1. 2017Attention Is All You Needcited by 59,932
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  5. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  6. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,355
  7. 2023Mistral 7Bcited by 3,065
  8. 2023A Survey of Large Language Modelscited by 2,537
  9. 2019RotatE: Knowledge Graph Embedding by Relational Rotation in Complex Spacecited by 893
  10. 2023Zephyr: Direct Distillation of LM Alignmentcited by 498
  11. 2019TuckER: Tensor Factorization for Knowledge Graph Completioncited by 290
  12. 2023GPT-NER: Named Entity Recognition via Large Language Modelscited by 158
19 more
  1. 2023From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacycited by 137
  2. 2023Revisiting Relation Extraction in the era of Large Language Modelscited by 100
  3. 2023LLMs for Knowledge Graph Construction and Reasoning: Recent Capabilities and Future Opportunitiescited by 97
  4. 2020PyKEEN 1.0: A Python Library for Training and Evaluating Knowledge Graph Embeddingscited by 77
  5. 2021NodePiece: Compositional and Parameter-Efficient Representations of Large Knowledge Graphscited by 71
  6. 2023GPT-RE: In-context Learning for Relation Extraction using Large Language Modelscited by 62
  7. 2022SecureBERT: A Domain-Specific Language Model for Cybersecuritycited by 60
  8. 2023Enhancing Knowledge Graph Construction Using Large Language Modelscited by 44
  9. 2023Aligning Instruction Tasks Unlocks Large Language Models as Zero-Shot Relation Extractorscited by 44
  10. 2023PiVe: Prompting with Iterative Verification Improving Graph-based Generative Capability of LLMscited by 44
  11. 2021AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reportscited by 31
  12. 2022Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTIcited by 27
  13. 2021Improving Inductive Link Prediction Using Hyper-Relational Factscited by 21
  14. 2023Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wildcited by 15
  15. 2023ChatIDS: Advancing Explainable Cybersecurity Using Generative AIcited by 12
  16. 2023On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptionscited by 10
  17. 2022ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Managementcited by 9
  18. 2022A review of knowledge graph application scenarios in cyber securitycited by 6
  19. 2021TINKER: A framework for Open source Cyberthreat Intelligencecited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 8; 2026: 5.

14 papers.

Sort:

By area:

  1. 2025Large Language Models Are Unreliable for Cyber Threat Intelligencecited by 5
  2. 2025AthenaBench: A Dynamic Benchmark for Evaluating LLMs in Cyber Threat Intelligencecited by 4
  3. 2024Evaluating the Usability of LLMs in Threat Intelligence Enrichmentcited by 2
  4. 2025Neuro-Symbolic AI for Cybersecurity: State of the Art, Challenges, and Opportunitiescited by 2
  5. 2025Adapting Large Language Models to Emerging Cybersecurity using Retrieval Augmented Generationcited by 2
  6. 2026Minerva: Reinforcement Learning with Verifiable Rewards for Cyber Threat Intelligence LLMscited by 2
  7. 2026TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Constructioncited by 1
  8. 2025Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniquescited by 0
  9. 2025TITAN: Graph-Executable Reasoning for Cyber Threat Intelligencecited by 0
  10. 2025FuseSampleAgg: One-Pass Neighborhood Estimation for Budgeted Knowledge-Graph Refresh and Validationcited by 0
  11. 2025The Road of Adaptive AI for Precision in Cybersecuritycited by 0
  12. 2026From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generationcited by 0
2 more
  1. 2026NeuroGraph: An AI Graph-Driven Neuro-Symbolic Framework for Explainable Threat Reasoning in Advanced Manufacturingcited by 0
  2. 2026Ranked by the Matcher: A Reproducibility Audit of Knowledge Graph Extraction from Threat Reportscited by 0