Multimedia CTI-Driven Cross-Network Attack Graph Analysis Framework Based on LLM

The increasing sophistication of cyber threats has positioned Cyber Threat Intelligence (CTI) as essential for cybersecurity, particularly against Advanced Persistent Threats. However, most CTI exists in unstructured multimedia formats, creating significant challenges for automated analysis in cross-network environments like Industrial Control Systems. This research leverages Large Language Models(LLMs) to extract attacker Tactics, Techniques, and Procedures from unstructured CTI and map them to the MITRE ATT&CK framework. Using over 120 real-world CTI samples encompassing text, video, audio, and image formats, we develop an automated pipeline that transforms multimedia data into structured threat intelligence and constructs risk-weighted attack graphs. Our experimental results demonstrate superior LLM-based entity extraction accuracy compared to traditional methods. The generated attack graphs visualize threat propagation paths across organizational assets, enabling security teams to prioritize critical attack vectors. Additionally, we propose a novel scoring mechanism incorporating cross-level transition analysis and bypass rate calculations. Through validation in simulated scenarios with 4-level architecture, this research establishes a foundation for integrating LLM-enhanced CTI processing into cyber security frameworks, providing adaptive solutions for similar network environments including military or financial networks.