# From Threat Intelligence to Firewall Rules: Semantic Relations in Hybrid AI Agent and Expert System Architectures

arXiv: https://arxiv.org/abs/2603.03911 · HTML: https://mlsanity.com/paper/2603.03911/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 23 references that are in the map.
- First posted on arXiv 4 Mar 2026.

## Builds on (most cited first, 10 of 10)

- [Chain-of-Thought Prompting Elicits Reasoning in Large Language Models](https://mlsanity.com/paper/2201.11903/) (2022)
- [MemoryBank: Enhancing Large Language Models with Long-Term Memory](https://mlsanity.com/paper/2305.10250/) (2023)
- [KG-Agent: An Efficient Autonomous Agent Framework for Complex Reasoning over Knowledge Graph](https://mlsanity.com/paper/2402.11163/) (2024)
- [Self-evolving Agents with reflective and memory-augmented abilities](https://mlsanity.com/paper/2409.00872/) (2024)
- [A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes](https://mlsanity.com/paper/2601.05293/) (2026)
- [Do Large Language Models Understand Word Senses?](https://mlsanity.com/paper/2509.13905/) (2025)
- [CTI-HAL: A Human-Annotated Dataset for Cyber Threat Intelligence Analysis](https://mlsanity.com/paper/2504.05866/) (2025)
- [A Formal Model of Security Controls' Capabilities and Its Applications to Policy Refinement and Incident Management](https://mlsanity.com/paper/2405.03544/) (2024)
- [Exploring Prompt-Based Methods for Zero-Shot Hypernym Prediction with Large Language Models](https://mlsanity.com/paper/2401.04515/) (2024)
- [A Neuro-Symbolic Multi-Agent Approach to Legal-Cybersecurity Knowledge Integration](https://mlsanity.com/paper/2510.23443/) (2025)

## Built on by (most cited first, 1 of 1)

- [RefinementEngine: Automating Intent-to-Device Filtering Policy Deployment under Network Constraints](https://mlsanity.com/paper/2604.01627/) (2026)

## Abstract (arXiv)

Web security demands rapid response capabilities to evolving cyber threats. Agentic Artificial Intelligence (AI) promises automation, but the need for trustworthy security responses is of the utmost importance. This work investigates the role of semantic relations in extracting information for sensitive operational tasks, such as configuring security controls for mitigating threats. To this end, it proposes to leverage hypernym-hyponym textual relations to extract relevant information from Cyber Threat Intelligence (CTI) reports. By leveraging a neuro-symbolic approach, the multi-agent system automatically generates CLIPS code for an expert system creating firewall rules to block malicious network traffic. Experimental results show the superior performance of the hypernym-hyponym retrieval strategy compared to various baselines and the higher effectiveness of the agentic approach in mitigating threats.