Schema-Agnostic Knowledge Graph Construction via Hybrid Ontology Discovery for Cyber Threat Intelligence

• URL: http://arxiv.org/abs/2606.01208v1
• Date: Sun, 31 May 2026 12:56:37 GMT
• Title: Schema-Agnostic Knowledge Graph Construction via Hybrid Ontology Discovery for Cyber Threat Intelligence
• Abstract summary: Cyber threat intelligence (CTI) reports serve as essential resources for capturing techniques and procedures observed in modern attack campaigns.<n>Traditional CTI platforms reduce this intelligence to isolated indicators through fixed schemas such as STIX.<n>Ontology-based representations preserve the relationships needed for structured threat analysis.<n>Existing approaches for ontology-aligned CTI extraction face three challenges.
• Score: 9.572153940128073
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Cyber threat intelligence (CTI) reports now serve as essential resources for capturing adversary tactics, techniques, and procedures observed in modern attack campaigns. While traditional CTI platforms reduce this intelligence to isolated indicators through fixed schemas such as STIX, ontology-based representations preserve the semantic relationships needed for structured threat analysis. However, existing approaches for ontology-aligned CTI extraction face three challenges: (i) schema-specific pipelines that require manual reconfiguration whenever the schema changes, (ii) prompt-based schema inclusion that fails to scale on large ontologies such as UCO, and (iii) reliance on enterprise LLM APIs that conflicts with privacy constraints when integrating sensitive internal incident data. In this paper, we present ANCHOR, a schema-agnostic CTI knowledge graph construction system that bridges LLMs and formal ontology schemas. At the core of ANCHOR is hybrid ontology discovery, a search-and-navigate mechanism that dynamically explores large-scale ontology schemas, combined with SHACL-based validation to enforce schema-compliant type assignments. Experimental results on the UCO, STIX, and MALOnt schemas show that ANCHOR outperforms existing baselines in ontology typing and schema compliance. In addition, ANCHOR with a local LLM closely matches enterprise LLM typing performance, enabling privacy-preserving CTI analysis with high fidelity.

Related papers

• Surprising Effectiveness of Self-Demonstrations in Enhancing Schema-Ontology Mapping with LLMs [23.62124559072917]
  This paper presents a self-demonstration-driven approach that combines a neuro-symbolic task decomposition with a novel mechanism for automatically generating pattern-guided demonstrations.<n> Experiments on three of the most challenging scenarios from the RODI benchmark show that our approach achieves state-of-the-art performance.
  arXiv  Detail & Related papers  (2026-09-12T07:42:55Z)
• An LLM-Based Framework for Intent-Driven Network Topology Design [0.8538830579425146]
  This work investigates the ability of Large Language Models to generate structurally valid and constraint-compliant network topologies.<n>The framework is evaluated via a multimodel comparison of proprietary and open-weight LLMs across four realistic network scenarios.<n>Overall, this work provides a systematic benchmark for understanding how LLMs handle structural and resilience constraints in topology synthesis.
  arXiv  Detail & Related papers  (2026-07-01T00:38:36Z)
• Automatic Ontology Construction Using LLMs as an External Layer of Memory, Verification, and Planning for Hybrid Intelligent Systems [0.0]
  This paper presents a hybrid architecture for intelligent systems in which large language models (LLMs) are extended with an external ontological memory layer.<n>The proposed approach constructs and maintains a structured knowledge graph using RDF/OWL representations, enabling persistent, verifiable, and semantically grounded reasoning.
  arXiv  Detail & Related papers  (2026-04-22T17:19:43Z)
• Beyond the Academic Monoculture: A Unified Framework and Industrial Perspective for Attributed Graph Clustering [75.50670592447219]
  Attributed Graph Clustering (AGC) is a fundamental unsupervised task that partitions nodes into cohesive groups by jointly modeling structural topology and node attributes.<n>This survey provides a comprehensive, industrially grounded review of AGC from three complementary perspectives.
  arXiv  Detail & Related papers  (2026-03-21T14:15:34Z)
• Autodiscover: A reinforcement learning recommendation system for the cold-start imbalance challenge in active learning, powered by graph-aware thompson sampling [0.0]
  This thesis introduces AutoDiscover, a framework that reframes active learning as an online decision-making problem driven by an adaptive agent.<n>On the 26-dataset SYNERGY benchmark, AutoDiscover achieves higher screening efficiency than static AL baselines.<n>We also introduce TS-Insight, an open-source visual analytics dashboard to interpret, verify, and diagnose the agent's decisions.
  arXiv  Detail & Related papers  (2026-02-04T22:16:50Z)
• Ontology-to-tools compilation for executable semantic constraint enforcement in LLM agents [0.0]
  We present a proof-of-principle mechanism for coupling large language models (LLMs) with formal domain knowledge semantics.<n>Ontological specifications are compiled into executable tool tools that LLM-based agents must use to create and modify knowledge graph instances.<n>We show how executable ontological semantics guide LLM interfaces and reduce manual schema and prompt engineering, establishing a general paradigm for embedding formal knowledge into generative systems.
  arXiv  Detail & Related papers  (2026-02-03T12:03:26Z)
• Topology Matters: A Cautionary Case Study of Graph SSL on Neuro-Inspired Benchmarks [3.9042998611300455]
  We introduce a hierarchical self-supervised learning (SSL) framework that jointly learns node-, edge-, and graph-level embeddings.<n>We construct a controllable synthetic benchmark mimicking the topological properties of connectomes.<n>Our results expose a fundamental pitfall in applying generic graph SSL to connectome-like data.
  arXiv  Detail & Related papers  (2026-02-03T07:35:54Z)
• Multi-Agent Collaborative Intrusion Detection for Low-Altitude Economy IoT: An LLM-Enhanced Agentic AI Framework [60.72591149679355]
  The rapid expansion of low-altitude economy Internet of Things (LAE-IoT) networks has created unprecedented security challenges.<n>Traditional intrusion detection systems fail to tackle the unique characteristics of aerial IoT environments.<n>We introduce a large language model (LLM)-enabled agentic AI framework for enhancing intrusion detection in LAE-IoT networks.
  arXiv  Detail & Related papers  (2026-01-25T12:47:25Z)
• Graph Neural Network Based Adaptive Threat Detection for Cloud Identity and Access Management Logs [0.0]
  This paper presents a Graph Neural Network Based Adaptive Threat Detection framework.<n>It learns latent user resource interaction patterns from IAM audit trails in real time.
  arXiv  Detail & Related papers  (2025-12-11T04:44:02Z)
• KBQA-R1: Reinforcing Large Language Models for Knowledge Base Question Answering [64.62317305868264]
  We present textbfKBQA-R1, a framework that shifts the paradigm from text imitation to interaction optimization via Reinforcement Learning.<n>Treating KBQA as a multi-turn decision process, our model learns to navigate the knowledge base using a list of actions.<n>Experiments on WebQSP, GrailQA, and GraphQuestions demonstrate that KBQA-R1 achieves state-of-the-art performance.
  arXiv  Detail & Related papers  (2025-12-10T17:45:42Z)
• Learning Efficient and Generalizable Graph Retriever for Knowledge-Graph Question Answering [75.12322966980003]
  Large Language Models (LLMs) have shown strong inductive reasoning ability across various domains.<n>Most existing RAG pipelines rely on unstructured text, limiting interpretability and structured reasoning.<n>Recent studies have explored integrating knowledge graphs with LLMs for knowledge graph question answering.<n>We propose RAPL, a novel framework for efficient and effective graph retrieval in KGQA.
  arXiv  Detail & Related papers  (2025-06-11T12:03:52Z)
• CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Models [49.657358248788945]
  Textual descriptions in cyber threat intelligence (CTI) reports are rich sources of knowledge about cyber threats.<n>Current CTI knowledge extraction methods lack flexibility and generalizability.<n>We propose CTINexus, a novel framework for data-efficient CTI knowledge extraction and high-quality cybersecurity knowledge graph (CSKG) construction.
  arXiv  Detail & Related papers  (2024-10-28T14:18:32Z)
• ALPINE: Unveiling the Planning Capability of Autoregressive Learning in Language Models [48.559185522099625]
  Planning is a crucial element of both human intelligence and contemporary large language models (LLMs) This paper investigates the emergence of planning capabilities in Transformer-based LLMs via their next-word prediction mechanisms.
  arXiv  Detail & Related papers  (2024-05-15T09:59:37Z)
• Provable Hierarchy-Based Meta-Reinforcement Learning [50.17896588738377]
  We analyze HRL in the meta-RL setting, where learner learns latent hierarchical structure during meta-training for use in a downstream task. We provide "diversity conditions" which, together with a tractable optimism-based algorithm, guarantee sample-efficient recovery of this natural hierarchy. Our bounds incorporate common notions in HRL literature such as temporal and state/action abstractions, suggesting that our setting and analysis capture important features of HRL in practice.
  arXiv  Detail & Related papers  (2021-10-18T17:56:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.