Pith. sign in

REVIEW 5 major objections 6 minor 53 references

MultiKG: Multi-Source Threat Intelligence Aggregation for High-Quality Knowledge Graph Representation of Attack Techniques

T0 review · 5 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read MultiKG builds a unified attack-technique knowledge graph from CTI reports, audit logs, and static code, claiming 93.8% log entity accuracy and roughly twice the cross-source F1 score of AttacKG.

desk verdict Genuinely new three-source attack graph pipeline, but the accuracy claims need independent labels and a fuller AttacKG comparison before they can be trusted. read the letter →

arxiv 2411.08359 v1 pith:F6I5JX76 submitted 2024-11-13 cs.CR

Jian Wang , Tiantian Zhu , Chunlin Xiong , Yan Chen This is my paper · ORCID
classification cs.CR
keywords attackknowledgegraphthreatintelligenceaggregationprovenanceauditloganalysisstaticcodelargelanguagemodelMITREATT&CKreconstruction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

MultiKG is a fully automated pipeline that turns three kinds of threat data into one attack-technique knowledge graph: natural-language cyber threat intelligence (CTI) reports, system audit logs captured while an attack actually runs, and the attack's source code. The paper's central claim is that these sources complement one another — reports provide coverage of technique variants, logs provide the true execution topology, and static code analysis restores nodes and edges that log filtering drops — so merging them produces graphs that are more complete and more accurate than graphs built from reports alone. In the authors' evaluations, MultiKG reaches 93.8% entity and 91.4% relationship accuracy on log-based graphs, 86.4% entity accuracy on CTI graphs, and roughly twice AttacKG's F1 score on cross-source merging. If the claim holds, security teams could automatically maintain a fine-grained, technique-level knowledge base that supports attack reconstruction and detection.

What carries the argument

The central mechanism is a three-lane extraction pipeline with two merging stages. Lane one reconstructs a dynamic provenance subgraph from ETW audit logs by following the process chain from a known starting process ID, then filters event types and removes whitelisted non-attack nodes. Lane two parses the attack script's abstract syntax tree to recover file, registry, and process entity names, matching them against the audit log to supplement missing nodes and edges. Lane three uses a large language model (GPT-4) with a purpose-built prompt to extract entities, entity types, and relationships from the technique descriptions in MITRE ATT&CK. Same-source graphs are merged by hierarchical level and content similarity; cross-source merging treats the log-plus-code graph as the base graph and the CTI graph as the additional graph, traverses the additional graph in breadth-first order, and merges a node only when type and content similarity match, otherwise attaching the node to its parent. A final generalization step replaces user-specific paths with wildcards and merges similar leaf nodes, producing a compact technique graph that spans variants.

What would settle it

Ask two or more independent analysts who have not seen MultiKG's output to annotate a held-out set of attack executions and CTI reports using the same entity and relationship schema, measure their agreement, and recompute precision and recall against those labels; if inter-annotator agreement is low or the independently measured F1 scores fall well below the reported 93.8% and 86.4% figures, the accuracy claims are not reproducible.

Watch

Extended reading notes

Core claim

The discovery is that attack knowledge from text, execution logs, and code can be converted separately into technique-level graphs and then merged into a single graph that is finer-grained than any single-source representation. MultiKG builds a 'base graph' from audit logs enriched by static code analysis, then folds in LLM-parsed CTI report graphs using breadth-first traversal and content-similarity matching; edges with no counterpart in the base graph are preserved by attaching them to their parent node. The paper reports that aggregation compresses log-based graph nodes by about 47% on average and CTI graph nodes by about 70%, while the cross-source merged graphs achieve node and edge F1 scores of 95.9% and 95.8% against manual ground truth — roughly twice the corresponding scores for AttacKG. The intended payoff is that downstream security tasks, including attack reconstruction, variant detection, and TTP-based detection, can consume these graphs directly.

Load-bearing premise

The accuracy figures rest on ground truth that the authors themselves hand-labeled — ten attack technique executions for the log-based graphs and eleven CTI reports for the report-based graphs, with the cross-source ground truth obtained by manually merging the same graphs the algorithm merges — so if those labels are incomplete, mistaken, or biased toward what MultiKG produces, the reported precision and recall overstate real performance.

Editorial extensions

If this is right

  • Technique-level knowledge graphs can be built automatically from heterogeneous sources instead of relying on manual CTI summarization.
  • Attack reconstruction can operate at technique granularity, because the merged graph contains the real execution path from logs plus variant details from reports and code.
  • Detectors that match against TTP heuristics can draw on a richer and more generalized knowledge base, potentially improving coverage of attack variants.
  • Same-source aggregation compresses redundant nodes and edges by roughly 47% to 70%, keeping the final graphs compact enough for practical matching and review.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: because cross-source merging matches graphs by MITRE technique number, reports describing attacks at a coarser or finer granularity than ATT&CK would need additional alignment logic to be absorbed correctly.
  • Beyond the paper: the CTI lane's quality is tied to the particular LLM and prompt used, so replacing GPT-4 and re-running the 11-report evaluation would directly test how much of the reported accuracy comes from the model rather than the framework.
  • Beyond the paper: the base-graph/additional-graph merge is source-agnostic in principle, so the same design could be extended to other telemetry sources such as network flows or endpoint detection data, provided nodes share comparable type and content similarity.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes MultiKG, a fully automated framework that constructs attack technique knowledge graphs by combining three data sources: CTI reports parsed with GPT-4, dynamic audit logs collected via ETW, and static code analyzed with abstract syntax trees. The framework builds separate technique-level graphs for each source, aggregates multiple same-source graphs using a same-level BFS merging rule, and then merges cross-source graphs into a unified technique knowledge graph. The authors evaluate the system on 1,015 Atomic Red Team procedures and 9,006 MITRE ATT&CK descriptions, reporting 93.8% entity accuracy and 91.4% relationship accuracy on 10 log-based executions, 86.4% entity accuracy on 11 CTI reports, compression ratios for aggregation, and an F1 score roughly twice that of AttacKG on a 6-technique cross-source comparison.

Significance. If the reported quantitative results hold, MultiKG would be a useful contribution: it is the first system presented here to integrate audit logs, static code, and CTI reports into a unified, technique-level attack knowledge graph, and the algorithmic pipeline is described in enough detail to be reimplemented. Concrete strengths include the large crawled dataset (1,015 procedures, 9,006 report descriptions), the concrete algorithm pseudocode for extraction and merging, and the case studies that illustrate downstream reconstruction and detection value. However, the demonstrated significance is currently limited by an evaluation that rests on small, author-created ground truth with no inter-annotator agreement, no released labels or code, and a selective AttacKG comparison. The engineering contribution is plausible, but the accuracy claims are not yet independently established.

major comments (5)
  1. [6.2.1, Tables 4-5] All RQ1 accuracy claims (93.8% entity, 91.4% relationship accuracy on 10 log-based graphs; 86.4% entity accuracy on 11 CTI reports) are computed against ground truth that the authors themselves created, with no annotation schema, no annotator count, no inter-annotator agreement measure, and no release of the labeled graphs, the GPT-4 prompt, or the code. As presented, the numbers are unfalsifiable, and this is load-bearing because every positive result in RQ1 is measured against these labels. Please release the annotation instructions and gold graphs, add at least a second annotator with an agreement statistic, or otherwise provide an external audit of the labels.
  2. [6.2.3, Table 7] The comparison with AttacKG is reported for only 6 of the 65 matched techniques, and the 6 are not shown to be representative of the full set. The abstract's claim that MultiKG's F1 is 'roughly twice as high' as AttacKG is based entirely on these 6 techniques (F1 0.959/0.958 vs 0.545/0.372 for nodes/edges). Without the full 65-technique comparison or a statistically justified sample, the headline cross-source claim is not demonstrated. Additionally, the ground truth for this table is a manual cross-source merge of the same graphs that MultiKG merges, creating a risk that the gold standard implicitly aligns with the method's behavior.
  3. [5.1, Algorithm 4] The same-level merging rule—merging nodes that share the same BFS level and type/process name—is justified only by the assertion that 'similar nodes follow similar calling relationships, share the same calling logic and are more likely to appear at the same level of the calling chain.' No quantitative validation of this assumption is provided, yet it is load-bearing for the aggregation module and thus for the compression ratios and the cross-source F1 scores. Please add an analysis or ablation showing that same-level merging preserves gold-standard nodes and edges across the labeled techniques, or compare it against content-only merging.
  4. [5.2, Algorithm 5] The cross-source merging algorithm uses a content-similarity threshold in FindMatchingNode/ContentSimilarity, but the threshold value is never specified and no sensitivity analysis is reported. The merging decisions, and therefore the Table 7 results, depend critically on this threshold. Please report the exact threshold and show how node/edge F1 varies with it on the labeled set.
  5. [6.2.2, Table 6] The effectiveness of the aggregation module is measured only through compression/retention rates. Compression alone does not demonstrate correctness: it could also reflect over-merging that discards discriminative detail. The paper does not check whether the aggregated graphs preserve the gold-standard nodes and edges from the labeled set. The table also contains internal inconsistencies: T1090.003 and T1615 have identical before/after CTI counts (59 entities, 52 edges before; 10/20 after) but report retention percentages of 83.051/61.538 and 16.949/38.462 respectively, and the text's average compression ratios of 47.41% and 44.45% do not match any aggregation of the table's values.
minor comments (6)
  1. [4.3.2] The GPT-4 parsing prompt is described as 'well-designed' but is never shown; without the prompt and model version, the CTI extraction component is not reproducible.
  2. [Abstract and 6.1] The statement that the system was 'evaluated using 1,015 real attack techniques and 9,006 attack intelligence entries' is misleading because the accuracy evaluation uses only 10 log executions and 11 CTI reports; the larger numbers are dataset statistics rather than evaluation instances.
  3. [Table 4] The header 'Overall Precious' should read 'Overall Precision'.
  4. [Table 2] The column header 'Event Nmae' contains a typo and should read 'Event Name'.
  5. [Throughout] The paper repeatedly uses 'CIT report' instead of 'CTI report' (e.g., in Section 4.3 and Section 6.2.3); please correct these typos.
  6. [6.2.3] The full cross-source comparison is said to show that AttacKG has 43.76% of the average number of nodes and 76.46% of the edges of MultiKG, but only a 15-technique sample is shown in Table 8; the complete results should be provided in a supplementary table.

Circularity Check

0 steps flagged · score 0.0 of 10

No construct-level circularity found; extraction and merging are algorithmic pipelines validated against hand-labeled ground truth, not derived from it.

full rationale

MultiKG's derivation chain does not reduce to its own inputs. Log-based graphs are built by PID-rooted process-chain expansion, event-type filtering, whitelist-based node removal, and edge aggregation (Algorithm 1). Static-code supplementation uses AST node extraction and log matching (Algorithm 2). CTI graphs come from GPT-4 parsing of report text (Algorithm 3). Same-source and cross-source merges are explicit graph algorithms (Algorithms 4 and 5). None of these steps fits a free parameter to the reported accuracy quantities, and no source-derived quantity is defined in terms of the final merged graph. The RQ1-RQ3 accuracy figures are computed against hand-labeled ground truth (Sections 6.2.1 and 6.2.3), not against any value the system itself emits, so the measurements are not forced by construction. The paper's genuine weaknesses are evaluative rather than circular: the ground truth is small and author-created (10 log executions, 11 reports, 6 cross-source merges), no inter-annotator agreement is reported, and the cross-source ground truth is a manual version of the same merge task the system performs, which makes the numbers vulnerable to confirmation bias. Those concerns affect external validity and reproducibility, but they do not make the claimed derivation equivalent to its inputs. The same-level merge heuristic is justified post hoc as confirmed by experimental results (Section 5.1), which is weak evidentiary support but not a self-referential reduction. The comparison with AttacKG uses prior work with an overlapping author as a baseline, not as load-bearing evidence, so it does not raise the circularity score. Overall, no significant circularity is present.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The core claims rest on domain assumptions about the representativeness of MITRE ATT&CK and Atomic Red Team, on the completeness of ETW logs, on GPT-4's extraction quality, and on an unvalidated same-level merging heuristic. There are no fitted numerical constants in a derivation sense, but several hand-chosen rules control what enters the final graph.

free parameters (4)
  • Cross-source node matching content-similarity threshold = unspecified ('high')
    Algorithm 5, line 12 requires ContentSimilarity to be 'high' to merge nodes across sources; the threshold is not quantified, so the reported accuracy depends on an unpublished hand-tuned criterion.
  • Audit log event type selection set = Table 2 list
    Section 4.1.3 selects event types by hand (ProcessStart, FileCreate, etc.) and discards others; graph completeness depends on this choice.
  • Non-attack node whitelist = collected from baseline system run
    Section 4.1.4 filters nodes using a whitelist of normal events gathered in a controlled environment; the whitelist is environment-specific and affects precision.
  • Same-level merging rule = algorithmic rule
    Section 5.1 merges process nodes with the same name at the same BFS level; the rule is asserted to work ('confirmed by our experimental results') without presenting the confirmation.
assumptions (5)
  • domain assumption MITRE ATT&CK technique taxonomy is the correct and complete labeling of attack behavior
    Entire evaluation aggregates graphs by ATT&CK technique numbers from MITRE ATT&CK (Section 6.1); if the taxonomy misrepresents real attack variants, the KG structure inherits the error.
  • domain assumption Atomic Red Team scripts are faithful implementations of the 282 techniques
    Section 3.3 uses Atomic Red Team as the base dataset for logs and code; results depend on these scripts being representative of real attacks.
  • domain assumption ETW audit logs in a controlled Windows VM capture all attack-relevant events
    Section 3.1 assumes the OS and auditing engine are trusted; Section 4.1 builds graphs only from events ETW reports, so missed events are invisible to the system.
  • domain assumption GPT-4 extracts attack entities and relationships from CTI reports correctly
    Section 4.3.2 relies on a 'well-designed prompt' with GPT-4 API; the prompt is not published, so the CTI module's behavior is not independently checkable.
  • ad hoc to paper Similar nodes appear at the same BFS level in attack graphs
    Section 5.1 states this as the basis for same-level merging and says it is 'confirmed by our experimental results', but no confirming experiment is shown.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MultiKG: Multi-Source Threat Intelligence Aggregation for High-Quality Knowledge Graph Representation of Attack Techniques." pith.science (2026). https://pith.science/paper/F6I5JX76

@misc{pith2026241108359,
  author       = {Pith},
  title        = {Pith review of: MultiKG: Multi-Source Threat Intelligence Aggregation for High-Quality Knowledge Graph Representation of Attack Techniques},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/F6I5JX76}},
  note         = {Machine review of arXiv:2411.08359}
}
read the original abstract

The construction of attack technique knowledge graphs aims to transform various types of attack knowledge into structured representations for more effective attack procedure modeling. Existing methods typically rely on textual data, such as Cyber Threat Intelligence (CTI) reports, which are often coarse-grained and unstructured, resulting in incomplete and inaccurate knowledge graphs. To address these issues, we expand attack knowledge sources by incorporating audit logs and static code analysis alongside CTI reports, providing finer-grained data for constructing attack technique knowledge graphs. We propose MultiKG, a fully automated framework that integrates multiple threat knowledge sources. MultiKG processes data from CTI reports, dynamic logs, and static code separately, then merges them into a unified attack knowledge graph. Through system design and the utilization of the Large Language Model (LLM), MultiKG automates the analysis, construction, and merging of attack graphs across these sources, producing a fine-grained, multi-source attack knowledge graph. We implemented MultiKG and evaluated it using 1,015 real attack techniques and 9,006 attack intelligence entries from CTI reports. Results show that MultiKG effectively extracts attack knowledge graphs from diverse sources and aggregates them into accurate, comprehensive representations. Through case studies, we demonstrate that our approach directly benefits security tasks such as attack reconstruction and detection.

Figures

Figures reproduced from arXiv: 2411.08359 by the authors.

Figure 1
Figure 1. Complete Attack Flow of APT-C-36 Reproduced Based on the Report. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Multi-Source Information Aggregation on Attack Technique [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Overview of MultiKG Architecture Based on this, we obtain information about the execution of the attack technique (e.g., execution period, attack-related process IDs, etc.), as well as complete system event data during execution. 4.1.2 Process Association Chain Analysis. Then, after getting the log event data, we began to screen the attack-related process chain. Since the environment in which the attack is performed… view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Attack Knowledge Graph Construction Process Thread File Internet Registry Image Event Type 0 20 40 60 80 Event Percentage(%) 4.13% 2.31% 3.19% 0.16% 89.67% 0.41% [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Statistics on the Percentage of Events in the System [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Static Analysis of Attack Scripts Based on Abstract Syntax Tree. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Compression ratio distribution of nodes and edges before and after aggregation for multiple procedure audit log [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: Compression ratio distribution of nodes and edges before and after aggregation for multiple knowledge graphs on the [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]
Figure 9
Figure 9. Figure 9: Cross-Source Knowledge Fusion Based on Multi-Source Threat Intelligence: A Case Study of [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 10
Figure 10. Figure 10: MultiKG for Attack Detection (APT-C-36) models, which greatly limits the accuracy and validity of the ex￾tracted results and challenges security personnel’s workload and technical background. In this paper, we try to improve this tech￾nical gap by using LLM to aggrega…
Figure 15
Figure 15. Figure 15: Example Graph of Abstract Syntax Tree Visualiza [PITH_FULL_IMAGE:figures/full_fig_p020_15.png]
Figure 14
Figure 14. Figure 14: Example of Attack Knowledge graphs Based on [PITH_FULL_IMAGE:figures/full_fig_p020_14.png]
Figure 12
Figure 12. Figure 12: Example of Post-Aggregation Attack Knowledge [PITH_FULL_IMAGE:figures/full_fig_p021_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

53 extracted references · 47 canonical work pages

  1. [1]

    APT-C-36 (Blind Eagle) Recent Attack Techniques Analysis

    APT-C-36 (Blind Eagle) 2023. APT-C-36 (Blind Eagle) Recent Attack Techniques Analysis. https://mp.weixin.qq.com/s/6YDnMAf0laiLKukJ04XLTQ

    work page 2023

  2. [2]

    APT-C-36: From NJRat to APT-C-36 Attack Chain Analysis

    APT-C-36: From NJRat to APT-C-36 2024. APT-C-36: From NJRat to APT-C-36 Attack Chain Analysis. https://cn-sec.com/archives/1482654.html

    work page arXiv 2024

  3. [3]

    Atomic Red Team

    AtomicRedTeam 2024. Atomic Red Team. https://www.atomicredteam.io/atomic- red-team/atomics/

    work page 2024

  4. [4]

    Adam Bates, Dave Jing Tian, Kevin RB Butler, and Thomas Moyer. 2015. Trust- worthy whole-system provenance for the Linux kernel. In USENIX Security Symposium

    work page 2015

  5. [5]

    Blind Eagle APT-C-36 Targets Colombia

    BlackBerry 2023. Blind Eagle APT-C-36 Targets Colombia. https://blogs. blackberry.com/en/2023/02/blind-eagle-apt-c-36-targets-colombia

    work page 2023

  6. [6]

    Tom B Brown. 2020. Language models are few-shot learners. arXiv preprint arXiv:2005.14165 (2020)

    arXiv 2020

  7. [7]

    CrowdStrike

    CrowdStrike 2024. CrowdStrike. https://www.crowdstrike.com/

    work page 2024

  8. [8]

    CybOX Project. 2021. CybOX - Cyber Observable Expression. https: //cyboxproject.github.io/ (accessed on 2021-09-17)

    work page 2021

Show all 53 references
  1. [9]

    Event Tracing for Windows (ETW)

    ETW 2024. Event Tracing for Windows (ETW). https://learn.microsoft.com/en- us/windows-hardware/drivers/devtest/event-tracing-for-windows--etw-

    2024

  2. [10]

    Peng Gao, Xiaoyuan Liu, Edward Choi, et al . 2021. A System for Automated Open-Source Threat Intelligence Gathering and Management. In SIGMOD

    2021

  3. [11]

    Peng Gao, Fei Shao, Xiaoyuan Liu, et al. 2021. Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligence. ICDE (2021)

    2021

  4. [12]

    Peng Gao, Xusheng Xiao, Ding Li, Zhichun Li, Kangkook Jee, Zhenyu Wu, Chung Hwan Kim, Sanjeev R Kulkarni, and Prateek Mittal. 2018. SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection. In USENIX Security Symposium

    2018

  5. [13]

    Peng Gao, Xusheng Xiao, Zhichun Li, Fengyuan Xu, Sanjeev R Kulkarni, and Prateek Mittal. 2018. AIQL: Enabling Efficient Attack Investigation from System Monitoring Data. In USENIX ATC

    2018

  6. [14]

    Wajih Ul Hassan, Adam Bates, and Daniel Marino. 2020. Tactical provenance analysis for endpoint detection and response systems. In IEEE S&P

    2020

  7. [15]

    Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates. 2019. Nodoze: Combatting threat alert fatigue with automated provenance triage. In network and distributed systems security symposium

    2019

  8. [16]

    Wajih Ul Hassan, Ding Li, Kangkook Jee, Xiao Yu, Kexuan Zou, Dawei Wang, Zhengzhang Chen, Zhichun Li, Junghwan Rhee, Jiaping Gui, et al. 2020. This is Why We Can’t Cache Nice Things: Lightning-Fast Threat Hunting using Suspicion-Based Hierarchical Storage. In ACSAC

    2020

  9. [17]

    Md Nahid Hossain, Sanaz Sheikhi, and R Sekar. 2020. Combating Dependence Explosion in Forensic Analysis Using Alternative Tag Propagation Semantics. In IEEE S&P. 18

    2020

  10. [18]

    Ghaith Husari, Ehab Al-Shaer, Mohiuddin Ahmed, Bill Chu, and Xi Niu. 2017. TTPDrill: Automatic and accurate extraction of threat actions from unstructured text of CTI Sources. In ACM International Conference Proceeding Series , Vol. Part F1325

    2017

  11. [19]

    Samuel T King and Peter M Chen. 2003. Backtracking intrusions. In SOSP

    2003

  12. [20]

    Samuel T King, Zhuoqing Morley Mao, Dominic G Lucchetti, and Peter M Chen

  13. [21]

    Dorian Kodelja, Romaric Besançon, and Olivier Ferret. 2019. Exploiting a more global context for event detection through bootstrapping. InEuropean conference on information retrieval. Springer, 763–770

    2019

  14. [22]

    Kyu Hyung Lee, Xiangyu Zhang, and Dongyan Xu. 2013. LogGC: garbage collecting audit log. In ACM CCS

    2013

  15. [23]

    Valentine Legoy, Marco Caselli, Christin Seifert, and Andreas Peter. 2020. Auto- mated retrieval of att&ck tactics and techniques for cyber threat reports. arXiv preprint arXiv:2004.14322 (2020)

    2020 arXiv

  16. [24]

    Xiaojing Liao, Kan Yuan, Xiaofeng Wang, et al . 2016. Acing the IOC Game: Toward Automatic Discovery and Analysis of Open-Source Cyber Threat Intelli- gence. In CCS

    2016

  17. [25]

    Yushan Liu, Mu Zhang, Ding Li, Kangkook Jee, Zhichun Li, Zhenyu Wu, Jungh- wan Rhee, and Prateek Mittal. 2018. Towards a Timely Causality Analysis for Enterprise Security.. In NDSS

    2018

  18. [26]

    Mandiant. 2021. mandiant/OpenIOC_1.1. https://github.com/mandiant/ OpenIOC_1.1 (accessed on 2021-09-17)

    2021

  19. [27]

    Noor Michael, Jaron Mink, Jason Liu, Sneha Gaur, Wajih Ul Hassan, and Adam Bates. 2020. On the Forensic Validity of Approximated Audit Logs. In ACSAC

    2020

  20. [28]

    Milajerdi, Rigel Gjomemo, Birhanu Eshete, et al

    Sadegh M. Milajerdi, Rigel Gjomemo, Birhanu Eshete, et al. 2019. Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting. In CCS. arXiv:1910.00056

    2019 arXiv

  21. [29]

    Sadegh M Milajerdi, Rigel Gjomemo, Birhanu Eshete, Ramachandran Sekar, and VN Venkatakrishnan. 2019. Holmes: real-time apt detection through correlation of suspicious information flows. In 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 1137–1152

    2019

  22. [30]

    MITRE ATTCK

    MITRE ATT&CK 2024. MITRE ATTCK. https://attack.mitre.org/

    2024

  23. [31]

    Sadegh Momeni Milajerdi, Rigel Gjomemo, et al. 2019. HOLMES: Real-time APT detection through correlation of suspicious information flows. In IEEE S&P

    2019

  24. [32]

    Dongliang Mu, Alejandro Cuevas, Limin Yang, et al. 2018. Understanding the reproducibility of crowd-reported security vulnerabilities. In Usenix Security Symposium

    2018

  25. [33]

    OASIS Open. 2021. Introduction to STIX. https://oasis-open.github.io/cti- documentation/stix/intro.html (accessed on 2021-09-17)

    2021

  26. [34]

    Devin J Pohly, Stephen McLaughlin, Patrick McDaniel, and Kevin Butler. 2012. Hi-Fi: collecting high-fidelity whole-system provenance. In ACSAC

    2012

  27. [35]

    Kiavash Satvat, Rigel Gjomemo, and VN Venkatakrishnan. 2021. EXTRACTOR: Extracting Attack Behavior from Threat Reports. In IEEE EuroS&P

    2021

  28. [36]

    Symantec

    Symantec 2024. Symantec. https://www.symantec.com/

    2024

  29. [37]

    Yutao Tang, Ding Li, Zhichun Li, Mu Zhang, Kangkook Jee, Xusheng Xiao, Zhenyu Wu, Junghwan Rhee, Fengyuan Xu, and Qun Li. 2018. Nodemerge: template based efficient data reduction for big-data causality analysis. In ACM CCS

    2018

  30. [38]

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. 2023. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971 (2023)

    2023 arXiv

  31. [39]

    Thijs van Ede, Hojjat Aghakhani, Noah Spahn, Riccardo Bortolameotti, Marco Cova, Andrea Continella, Maarten van Steen, Andreas Peter, Christopher Kruegel, and Giovanni Vigna. 2022. DeepCASE: Semi-Supervised Contextual Analysis of Security Events. In IEEE Security and Privacy

    2022

  32. [40]

    Lingzhi Wang, Jiahui Wang, Kyle Jung, Kedar Thiagarajan, Emily Wei, Xi- angmin Shen, Yan Chen, and Zhenyuan Li. 2024. From Sands to Man- sions: Enabling Automatic Full-Life-Cycle Cyberattack Construction with LLM. arXiv:2407.16928 [cs.CR] https://arxiv.org/abs/2407.16928

    2024

  33. [41]

    Zongzong Wu, Fengxiao Tang, Ming Zhao, and Yufeng Li. 2024. KGV: Integrating Large Language Models with Knowledge Graphs for Cyber Threat Intelligence Credibility Assessment. arXiv:2408.08088 [cs.CR] https://arxiv.org/abs/2408. 08088

    2024 arXiv

  34. [42]

    Maxime Würsch, Andrei Kucharavy, Dimitri Percia David, and Alain Mermoud

  35. [43]

    Chunlin Xiong, Tiantian Zhu, Weihao Dong, Linqi Ruan, Runqing Yang, Yueqiang Cheng, Yan Chen, Shuai Cheng, and Xutong Chen. 2020. CONAN: A practical real- time APT detection system with high accuracy and efficiency. IEEE Transactions on Dependable and Secure Computing 19, 1 (2...

    2020

  36. [44]

    Zhang Xu, Zhenyu Wu, Zhichun Li, Kangkook Jee, Junghwan Rhee, Xusheng Xiao, Fengyuan Xu, Haining Wang, and Guofei Jiang. 2016. High fidelity data reduction for big data security dependency analyses. In ACM CCS

    2016

  37. [45]

    Runqing Yang, Shiqing Ma, Haitao Xu, Xiangyu Zhang, and Yan Chen. 2020. UIScope: Accurate, Instrumentation-free, and Visible Attack Investigation for GUI Applications.. In NDSS

    2020

  38. [46]

    Jun Zeng, Zheng Leong Chua, Yinfang Chen, Kaihang Ji, Zhenkai Liang, and Jian Mao. 2021. WATSON: Abstracting Behaviors from Audit Logs via Aggregation of Contextual Semantics.. In NDSS

    2021

  39. [47]

    Jun Zeng, Zheng Leong Chua, Yinfang Chen, Kaihang Ji, Zhenkai Liang, and Jian Mao. 2021. WATSON: Abstracting Behaviors from Audit Logs via Aggregation of Contextual Semantics. In NDSS

    2021

  40. [48]

    Yongheng Zhang, Tingwen Du, Yunshan Ma, Xiang Wang, Yi Xie, Guozheng Yang, Yuliang Lu, and Ee-Chien Chang. 2024. AttacKG+:Boosting Attack Knowledge Graph Construction with Large Language Models. arXiv:2405.04753 [cs.CR] https://arxiv.org/abs/2405.04753

    2024 arXiv

  41. [49]

    Yue Zhao, Xiaolong Jin, Yuanzhuo Wang, and Xueqi Cheng. 2018. Document embedding enhanced event detection with hierarchical and supervised attention. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers) . 414–419

    2018

  42. [50]

    Li Zhenyuan, Soltani Ahmad, Yusof Anis, Cahyadi Risdianto Aris, Huang Kang, Zeng Jun, Liang Zhenkai, and Chen Yan. 2022. Poster: Towards Automated and Large-scale Cyber Attack Reconstruction with APT Reports. In The annual Network and Distributed System Security (NDSS) Symposium 2022

    2022

  43. [51]

    Ziyun Zhu and Tudor Dumitras. 2018. ChainSmith: Automatically Learning the Semantics of Malicious Campaigns by Mining Threat Intelligence Reports. In IEEE European Symposium on Security and Privacy . 19 (C) APT19 (a) APT38 (d) BLINDINGCAN (b) APT32 Figure 13: Attack Knowledge ...

    2018

  44. [2005]

    Enriching Intrusion Alerts Through Multi-Host Causality.. In NDSS

  45. [2023]

    arXiv preprint arXiv:2312.07110 (2023)

    LLMs Perform Poorly at Concept Extraction in Cyber-security Research Literature. arXiv preprint arXiv:2312.07110 (2023)

    2023 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.