arXiv Computation and Language August 31, 2026 By Changze Li, Yutong Cheng, Tsania Camila Finnisa, Qian Cui, Wei Ding, Peng Gao

BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligence

Read the original on arXiv Computation and Language →

The Flow has not summarised this story yet — read it at arXiv Computation and Language.

arXiv AI

Jun 6

CTIConnect: A Benchmark for Retrieval-Augmented LLMs over Heterogeneous Cyber Threat Intelligence

arXiv:2510. 11974v2 Announce Type: replace-cross Abstract: Cyber Threat Intelligence (CTI) is foundational to modern cybersecurity, enabling organizations to proactively defend against evolving threats.

By Yutong Cheng, Yang Liu, Changze Li, Dawn Song, Peng Gao

llms rag benchmarks

arXiv AI

Jul 23

An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

arXiv:2607. 19742v1 Announce Type: cross Abstract: Cyber Threat Intelligence (CTI) reports richly describe real-world attack processes, but their unstructured narratives cannot be directly used for automated attack-path reasoning.

By Wenbo Hou, Ning Hu, Xueping Wang, Jiahao Gu, Wenjian Luo

llms

arXiv AI

Jul 28

TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs

arXiv:2607. 24563v1 Announce Type: new Abstract: Security Operations Centers increasingly rely on automated mapping of Cyber Threat Intelligence reports to MITRE ATT&CK, yet extractor outputs remain fallible and are often stored without the evidence, provenance, and validation history needed to decide whether an individual mapping should be trusted.

By Federico Valletta, Giacomo Longo, Enrico Russo, Alessio Merlo

arXiv AI

Jul 1

CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors

arXiv:2606. 31557v1 Announce Type: cross Abstract: In the evolving threat landscape, adversaries exploit software vulnerabilities to launch sophisticated attacks, challenging traditional defenses.

By Basant Agarwal, Dincy R. Arikkat, Swati Yadav, Serena Nicolazzo, Antonino Nocera, Vinod P

llms

arXiv Machine Learning

Jun 17

Evaluating Open-Source LLMs for Multi-Label ATT&CK Technique Classification on CTI Reports

arXiv:2606. 18166v1 Announce Type: cross Abstract: Classifying Cyber Threat Intelligence (CTI) using MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) is essential for proactive defense, but historically required extensive human effort.

By Ahmed Ryan, Saad Sakib Noor, Md Erfan, Shaswata Mitra, Sudip Mittal, Md Rayhanur Rahman

llms benchmarks safety

arXiv Machine Learning

Jun 17

Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluation

arXiv:2606. 18190v1 Announce Type: cross Abstract: Multi-stage cyberattacks span system, network, and browser logs.

By Abir Ashab Niloy, Ahmed Ryan, Imamul Hossain Rafi, Md Erfan, Md Rayhanur Rahman

llms fine-tuning safety

One email a morning, machine-written

Related stories

CTIConnect: A Benchmark for Retrieval-Augmented LLMs over Heterogeneous Cyber Threat Intelligence

An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs

CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors

Evaluating Open-Source LLMs for Multi-Label ATT&CK Technique Classification on CTI Reports

Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluation