Didact: A Cross-Domain Capability Discovery System for Defence

Aarya Bodhankar; Aditya Joshi; Bao Gia Doan; Thomas Marchant; Oscar Leslie; Flora Salim

cs.CLJun 5, 2026

Didact: A Cross-Domain Capability Discovery System for Defence

Authors: Aarya Bodhankar, Aditya Joshi, Bao Gia Doan, Thomas Marchant, Oscar Leslie, Flora Salim

Organizations: University of New South Wales · Sydney, Australia · Australia · Cyndr.ai, Australia

Abstract

Policymakers in defence and defence-aligned sectors must monitor rapidly evolving research alongside sector priorities relevant to operational and strategic needs. In practice, these sources are fragmented across heterogeneous formats, disjoint repositories, and siloed update streams, making capability discovery slow and difficult to audit. We present Didact, a prototype that integrates publicly available defence reports and policy documents from Australia with a purpose-built knowledge graph derived from Australian research publications. Didact provides natural language conversations for policy-oriented workflows, and leverages a composite retrieval-augmented generation (RAG) pipeline. A key feature of Didact is an interactive Evidence Rail that visualises retrieved evidence and source relationships. Our evaluation of the output quality and runtime of Didact highlights its utility. While Didact has been co-developed as an academia-industry project for the Australian context, it is adaptable to other domains where knowledge is similarly fragmented. A demonstration video is available here:

Explore similar work

Operationalizing Cyber Threat Intelligence with GraphRAG
Aug 13, 2026Atul Kabra, Prakhar Paliwal, Manjesh K. HanawalCyber Threat Intelligence Cybersecurity
A Benchmark Construction and Evaluation Framework for Specialist Domains: Case Study on Defense-related Documents
Apr 20, 2026Bao Gia Doan, Aditya Joshi, Pantelis Elinas +4Multi-Hop Question Answering Benchmarks Recent Retrieval-Augmented Generation
KadiAssistant: A conversational AI Agent for information retrieval in Kadi4Mat
May 13, 2026Adrian Cierpka, Mohammad Shafiqul Islam, Johannes Steinhülb +3Retrieval Task Knowledge Graphs

Aug 13, 2026 · cs.CRJ/K move · Enter open · S save

Operationalizing Cyber Threat Intelligence with GraphRAG

Atul Kabra, Prakhar Paliwal, Manjesh K. Hanawal

When a security researcher publishes a report on a cyberattack, detection engineers are supposed to turn it into working detection rules. In practice, most automated attempts at this only extract the simplest clues from the report --- bad IP addresses, domain names, and file hashes --- and turn them into block lists. This is a weak strategy, because attackers can change these simple clues within hours or days, so the resulting detections stop working almost as soon as they are deployed. Security teams describe this idea with the Pyramid of Pain. This project asks whether feeding a report into a knowledge-graph retrieval system, Microsoft GraphRAG, rather than a standard vector-similarity retrieval system (Naive RAG), produces detection plans that rely more on these durable, top-of-pyramid clues. Both systems are given the same report, the same generation instructions, and the same language model to write the final plan; only the retrieval step differs. In a detailed case study of one APT28 report, the GraphRAG plan kept firing at 100% of its detections after every IP address, domain, and file hash in the report was rotated, while the Naive RAG plan kept firing at only 29%. Repeating the comparison across nine real CTI reports from four vendors confirms the same pattern: GraphRAG plans consistently reach higher, harder-to-evade levels of the pyramid, even when the two systems end up close on total score. The results support treating knowledge-graph-aware retrieval as the architecturally correct foundation for automatically generating SOC-deployable hunting plans, while showing that the wording of the generation prompt matters almost as much as the retrieval back-end itself.

Cyber Threat Intelligence Cybersecurity Knowledge Graphs Graph-Based Retrieval Augmented Generation Retrieval-Augmented Generation Systems

Open paper Ask about it PDF

Abstract

Explore similar work

Operationalizing Cyber Threat Intelligence with GraphRAG

A Benchmark Construction and Evaluation Framework for Specialist Domains: Case Study on Defense-related Documents

KadiAssistant: A conversational AI Agent for information retrieval in Kadi4Mat