Cyber Threat Intelligence

Follow this topic Ask about this topic

Momentum

4 papers in the last four weeks, against 1 the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 21

All topics

A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK
Sep 14, 2026Matteo Lupinacci, Luigi Arena, Francesco Blefari +1Cyber Threat Intelligence Multivariate Telemetry Data
University of Calabria Rende, ITA
Architecting the Secure AI-SOC: A Neurosymbolic Framework for Pipeline Integrity and Threat Mitigation
Sep 12, 2026Anna Gazani, Spyridon Kounoupidis, Panagiotis Katsaros +3Indirect Prompt Injection Cyber Threat Intelligence
Aristotle University of Thessaloniki, Greece · Clone Systems, Cyprus
A Training-Free, Alignment-Free Approach to Corporate Intelligence: Application to SEC Filings
Sep 11, 2026Jean-François DelpechText Corpora Cyber Threat Intelligence
WebGlyphs, Inc. Mesa, AZ 85203
Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports
Sep 8, 2026Akash Prakash, Boubakr Nour, Makan Pourzandi +2Cyber Threat Intelligence Systematic Study
Concordia University, Canada · Ericsson Security Research, Canada
Operationalizing Cyber Threat Intelligence with GraphRAG
Aug 13, 2026Atul Kabra, Prakhar Paliwal, Manjesh K. HanawalCyber Threat Intelligence Cybersecurity
MLiONS, Department of IEOR, IIT Bombay Mumbai, Maharashtra, India
The Anatomy of a Prompt Injection: A Component Model for Structured Analysis
Aug 7, 2026Jeremy McHughPrompt-Injection Detectors Cyber Threat Intelligence
Preamble, Inc.
Retrieval-Constrained Policy Optimization for Attack Technique Extraction from Cyber Threat Intelligence
Aug 7, 2026Jiayun Zhang, Junshen Xu, Zejun Xie +1Cyber Threat Intelligence Threat
Amazon Web Services New York, New York, USA · Amazon Web Services Boston, Massachusetts, USA · Rutgers University Piscataway, New Jersey, USA
TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs
Jul 27, 2026Federico Valletta, Giacomo Longo, Enrico Russo +1Cyber Threat Intelligence Provenance
CASD – School of Advanced Defense Studies, Piazza della Rovere 83, 00165 Rome, Italy
An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports
Jul 22, 2026Wenbo Hou, Ning Hu, Xueping Wang +2Cyber Threat Intelligence Report
Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies, School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, China · New Network Research Department, Peng Cheng Laboratory, Shenzhen, China · Great Bay University, Dongguan, China
From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure
Jul 9, 2026Lea Roxanne Muth, Marian MargrafSafety-Critical Infrastructure Cyber Threat Intelligence
Department of Mathematics and Computer Science Freie Universität Berlin Berlin, Germany
TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction
Jul 6, 2026Mouhamed Amine Bouchiha, Gregory BlancCyber Threat Intelligence Tactics
SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris
Application of LLMs to Threat Assessment of Foreign Peacekeeping Missions
Jun 25, 2026Gerhard Backfried, Christian Schmidt, Diego Pilutti +1Large Language Model Safety Threat
HENSOLDT Austria, Vienna, Austria · Austrian Ministry of Defence, Vienna, Austria
A Hybrid, Multi-Layered Pipeline for Phishing and Threat Classification: Independently Validated URL and NLP Engines with a Calibrated Multi-Channel Fusion Stage
Jun 19, 2026Saifelden M. Ismail, Aser O. Ibrahim, Omar A. MahmoudPhishing Cyber Threat Intelligence
Department of Communications and Information Engineering Zewail City of Science and Technology, Giza, Egypt
Evaluating Open-Source LLMs for Multi-Label ATT&CK Technique Classification on CTI Reports
Jun 16, 2026Ahmed Ryan, Saad Sakib Noor, Md Erfan +3Cyber Threat Intelligence Attacker Large Language Model
The University of Alabama · The University of Dhaka
GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks
Jun 4, 2026Hassan Jalil Hadi, Rehana Yasmin, Ali ShokerIntrusion Detection Cyber Threat Intelligence
Cyber Security and Resilience Technology (CyberSaR), King Abdullah University of Science and Technology (KAUST), Saudi Arabia
MAECO-Lite: Modular Ontology for Dynamic Malware Analysis
May 29, 2026Zekeri Adams, Peter Švec, Ján Kľuka +4Malware Cyber Threat Intelligence
Department of Applied Informatics, Comenius University in Bratislava, Mlynská dolina, 842 48 Bratislava, Slovakia · Institute of Computer Science and Mathematics, Faculty of Electrical Engineering and Information Technology, Slovak University of Technology, Ilkoviˇcova 3, Bratislava, Slovakia
TTPrint: Evidence-Grounded TTP Extraction via Diverge-then-Converge Verification
May 25, 2026Yutong Cheng, Changze Li, Raihan Sultan Pasha Basuki +3Cyber Threat Intelligence
Virginia Tech · Universitas Ary Ginanjar, Jakarta, Indonesia · Amazon
Signals in the Noise: Open Source Intelligence (OSINT) for AI Loss of Control Detection
May 22, 2026Sarah Bollinger, Nada Aboserie, Amanda Coakley +2Cyber Threat Intelligence Artificial Intelligence Risk
AI Governance Taskforce, Arcadia Impact
Context-aware Entity-Relation Extraction for Threat Intelligence Knowledge Graphs
May 15, 2026Inoussa Mouiche, sherif SaadCyber Threat Intelligence Relation Extraction
School of Computer Science, University of Windsor, ON, Canada
TIJERE: A Novel Threat Intelligence Joint Extraction Model Based on Analyst Expert Knowledge
May 3, 2026Inoussa Mouiche, Sherif SaadCyber Threat Intelligence Relation Extraction
School of Computer Science, University of Windsor, 401 Sunset Ave, Windsor, N9B 3P4, ON, Canada
FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection
Aug 26, 2025Shaswata Mitra, Subash Neupane, Martin Duclos +5Cyber Threat Intelligence Intrusion Detection
The University of Alabama · Meharry Medical College · The University of Texas at El Paso

Sep 14, 2026, cs.CRJ/K move · Enter open · S save

A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

Matteo Lupinacci, Luigi Arena, Francesco Blefari, Angelo Furfaro

University of Calabria Rende, ITA

Cyber Threat Intelligence Multivariate Telemetry Data Behavior Tree Adversarial Robustness Knowledge Graphs

Open paper AskPDF arXiv

Mapping observed system behavior to standardized frameworks like MITRE ATT&CK is essential for threat-informed defense, but remains largely manual. Existing automated methods depend on Cyber Threat Intelligence reports, which offer only retrospective accounts of attacks. Low-level telemetry, i.e. kernel-level system calls, instead provides evidence of adversary behavior, yet its volume and complexity have limited its use for automated mapping. We present a methodology that collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning. These representations are mapped to the MITRE ATT&CK framework using both pure LLM prompting and retrieval-augmented generation (RAG) grounded in the ATT&CK knowledge base, producing ranked technique candidates along with supporting rationales. We implement this methodology as an end-to-end pipeline, named Trace2ATT&CK and evaluate it on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improves ATT&CK mapping performance over pure prompting, while provenance graph substantially outperforms raw telemetry. These results show that local inference over graph-based behavioral descriptions can make automated ATT&CK mapping from kernel-level telemetry operationally viable, without compromising data confidentiality.

Momentum

Related topics

Latest papers 21