# AURA: A Multi-Agent Intelligence Framework for Knowledge-Enhanced Cyber Threat Attribution

arXiv: https://arxiv.org/abs/2506.10175 · HTML: https://mlsanity.com/paper/2506.10175/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation.
- Builds on 12 of its 35 references that are in the map.
- First posted on arXiv 11 Jun 2025.

## Placed in

- Retrieval-augmented generation / [Privacy and security of RAG](https://mlsanity.com/rag/privacy-and-security-of-rag/)
- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 12 of 12)

- [Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena](https://mlsanity.com/paper/2306.05685/) (2023)
- [Evaluating Large Language Models Trained on Code](https://mlsanity.com/paper/2107.03374/) (2021)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation](https://mlsanity.com/paper/2308.08155/) (2023)
- [A Survey on LLM-as-a-Judge](https://mlsanity.com/paper/2411.15594/) (2024)
- [SPoC: Search-based Pseudocode to Code](https://mlsanity.com/paper/1906.04908/) (2019)
- [TTPXHunter: Actionable Threat Intelligence Extraction as TTPs from Finished Cyber Threat Reports](https://mlsanity.com/paper/2403.03267/) (2024)
- [DeepAPT: Nation-State APT Attribution Using End-to-End Deep Neural Networks](https://mlsanity.com/paper/1711.09666/) (2017)
- [Towards Effective Identification of Attack Techniques in Cyber Threat Intelligence Reports using Large Language Models](https://mlsanity.com/paper/2505.03147/) (2025)
- [MaLAware: Automating the Comprehension of Malicious Software Behaviours using Large Language Models (LLMs)](https://mlsanity.com/paper/2504.01145/) (2025)
- [On Technique Identification and Threat-Actor Attribution using LLMs and Embedding Models](https://mlsanity.com/paper/2505.11547/) (2025)
- [Chasing the Shadows: TTPs in Action to Attribute Advanced Persistent Threats](https://mlsanity.com/paper/2409.16400/) (2024)

## Built on by (most cited first, 3 of 3)

- [CyberRAG: An Agentic RAG cyber attack classification and reporting tool](https://mlsanity.com/paper/2507.02424/) (2025)
- [CTFExplorer: Evaluating LLM Offensive Agents Through Multi-Target Web CTF Benchmarking](https://mlsanity.com/paper/2602.08023/) (2026)
- [MALCDF: A Distributed Multi-Agent LLM Framework for Real-Time Cyber](https://mlsanity.com/paper/2512.14846/) (2025)

## Abstract (arXiv)

Effective attribution of Advanced Persistent Threats (APTs) increasingly hinges on the ability to correlate behavioral patterns and reason over complex, varied threat intelligence artifacts. We present AURA (Attribution Using Retrieval-Augmented Agents), a multi-agent, knowledge-enhanced framework for automated and interpretable APT attribution. AURA ingests diverse threat data including Tactics, Techniques, and Procedures (TTPs), Indicators of Compromise (IoCs), malware details, adversarial tools, and temporal information, which are processed through a network of collaborative agents. These agents are designed for intelligent query rewriting, context-enriched retrieval from structured threat knowledge bases, and natural language justification of attribution decisions. By combining Retrieval-Augmented Generation (RAG) with Large Language Models (LLMs), AURA enables contextual linking of threat behaviors to known APT groups and supports traceable reasoning across multiple attack phases. Experiments on recent APT campaigns demonstrate AURA's high attribution consistency, expert-aligned justifications, and scalability. This work establishes AURA as a promising direction for advancing transparent, data-driven, and scalable threat attribution using multi-agent intelligence.