AttacKG plus : Boosting attack graph construction with Large Language Models

Yongheng Zhang

doi:10.1016/j.cose.2024.104220

AttacKG plus : Boosting attack graph construction with Large Language Models

2025-03-01

0

OA

AI

DOI：10.1016/j.cose.2024.104220

原文链接

查看原文

摘要

En 中文

Attack graph construction seeks to convert textual cyber threat intelligence (CTI) reports into structured representations, portraying the evolutionary traces of cyber attacks. Even though previous research has proposed various methods to construct attack graphs, they generally suffer from limited generalization capability to diverse knowledge types as well as requirement of expertise in model design and tuning. Addressing these limitations, we seek to utilize Large Language Models (LLMs), which have achieved enormous success in abroad range of tasks given exceptional capabilities in both language understanding and zeroshot task fulfillment. Thus, we propose a fully automatic LLM-based framework to construct attack graphs named: AttacKG+. Our framework consists of four consecutive modules: rewriter, parser, identifier, and summarizer, each of which is implemented by instruction prompting and in-context learning empowered by LLMs. Furthermore, we upgrade the existing attack knowledge schema and propose a comprehensive version. We represent a cyber attack as a temporally unfolding event, each temporal step of which encapsulates three layers of representation, including behavior graph, MITRE TTP labels, and state summary. Extensive evaluation demonstrates that: (1) our formulation seamlessly satisfies the information needs in threat event analysis, (2) our construction framework is effective in faithfully and accurately extracting the information defined by AttacKG+. and (3) our attack graph directly benefits downstream security practices such as attack reconstruction. All the code and datasets will be released upon acceptance.

Keyword:

Cyber threat intelligence analysis

Attack graph construction

Large Language Models

AttacKG plus : Boosting attack graph construction with Large Language Models

摘要

AI总结

期刊

机构

引用论文