Automated Attack Knowledge Graph Construction with Large Language Models

The construction of attack knowledge graphs aims to transform unstructured Cyber Threat Intelligence (CTI) reports into structured representations, playing a vital role in accurately identifying and swiftly responding to network threats. Automating this process is essential for scalability and efficiency. Existing automated approaches, relying on fixed classifications or ontology-driven methods that require expert tuning, suffer from issues such as limited generalization, high manual overhead, and insufficient semantic understanding. To address these limitations, this paper leverages the superior language comprehension and zero-shot task capabilities of large language models (LLMs) to propose LLM-CAKG, a technology for automated construction of attack knowledge graph based on LLMs. This method uses domain knowledge to guide LLMs to sequentially perform entity extraction and relation recognition in two stages, normalizes and integrates all extracted triples, and then applies an LLM-driven iterative clustering algorithm to generate the final attack knowledge graph. The accuracy of this method was evaluated using 10 cyber threat reports collected from real-world cases, and the evaluation demonstrates its effectiveness in the automatic construction of attack knowledge graph compared with state-of-the-art approaches.