CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors

• URL: http://arxiv.org/abs/2606.31557v2
• Date: Mon, 06 Jul 2026 06:32:04 GMT
• Title: CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors
• Abstract summary: This work bridges the gap by connecting vulnerabilities with behavioral patterns from the MITRE ATT&CK framework.<n> Transformer-based models are developed for behavior identification, with CySecBERT achieving macro F1-scores of 87.71% (techniques) and 96.16% (tactics)<n>These outputs are integrated into a Neo4j-based Cyber Threat Knowledge Graph, enabling structured visualization of vulnerabilities.
• Score: 3.4943147506551555
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: In the evolving threat landscape, adversaries exploit software vulnerabilities to launch sophisticated attacks, challenging traditional defenses. Although databases like CVE and NVD provide detailed technical information, they often lack links to attacker behaviors such as tactics and techniques, limiting effective threat interpretation and response. This work bridges this gap by connecting vulnerabilities with behavioral patterns from the MITRE ATT&CK framework. We construct a CVE-TTP Knowledge Graph that links CVEs to tactics and techniques using classification and relation extraction. Transformer-based models are developed for behavior identification, with CySecBERT achieving macro F1-scores of 87.71% (techniques) and 96.16% (tactics). Also, we created an annotated dataset with 24,820 entities and 43,608 relations for entity and relation extraction. The pipeline-based approach achieves macro F1-scores of 0.86 (entity extraction) and 0.99 (relation extraction), while a span-based joint model achieves 0.78. These outputs are integrated into a Neo4j-based Cyber Threat Knowledge Graph, enabling structured visualization of vulnerabilities.

Related papers

• BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligence [12.412754988937644]
  Cyber threat intelligence (CTI) is foundational to modern cyber defense.<n> BEACON is a framework for cross-source CTI knowledge graph construction.<n>We release two human-annotated datasets from 34 sources.
  arXiv  Detail & Related papers  (2026-08-28T14:49:46Z)
• Defending against Model Extraction for GNNs with Model Reprogramming [57.82196268649236]
  Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (ML)<n>Still, their black-box deployment exposes them to Model Extraction (ME) attacks.<n>Existing defenses suffer from a critical ''Euclidean bias''<n>We propose GraphRP, a proactive defense framework that repurposes Model Reprogramming for security.
  arXiv  Detail & Related papers  (2026-08-11T23:20:15Z)
• Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilities [0.30915521808748864]
  We evaluate open-weight Large Language Models (LLMs) for generating Structured Threat Information Expression (STIX)<n>We construct a dataset called CAV-STIX that maps vulnerability descriptions to STIX domain objects (SDO), STIX objects (SRO), Common Weaknession (CWE), and MITRE ATT&CK techniques mappings.
  arXiv  Detail & Related papers  (2026-07-17T17:55:19Z)
• Beyond Homophily: Towards Generalized Graph Reconstruction Attack and Defense [80.28330585803133]
  Graph neural networks (GNNs) are widely deployed on computation data, yet they can leak sensitive or proprietary information about the training graph adjacency.<n>This work studies graph reconstruction attacks (GRA), a form of model inversion that reconstructs the training adjacency from a trained GNN.<n>We propose MC-GRA (+), which reconstructs the adjacency by optimizing a surrogate adjacency whose GNN-induced representations align with those of the target model.<n>On the defense side, we propose MC-GPB (+), which suppresses adjacency-dependent information throughout the representation chain
  arXiv  Detail & Related papers  (2026-06-06T09:29:27Z)
• Towards Predicting Multi-Vulnerability Attack Chains in Software Supply Chains from Software Bill of Materials Graphs [1.628589561701473]
  We propose a new research direction based on learning multi-vulnerability attack chains through a novel SBOM-driven graph-learning approach.<n>This treats SBOM structure and scanner outputs as a dependency-constrained evidence graph rather than a flat list of vulnerabilities.<n>We train a Heterogeneous Graph Attention Network (HGAT) to predict whether a component is associated with at least one known vulnerability.<n>We frame the discovery of vulnerabilities as CVE-pair link prediction using a lightweight Multi-Layer Perceptron (MLP) neural network trained on documented multi-vulnerability chains.
  arXiv  Detail & Related papers  (2026-04-04T17:29:39Z)
• The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search [58.8834056209347]
  Large language models (LLMs) remain vulnerable to jailbreak attacks that bypass safety guardrails to elicit harmful outputs.<n>We introduce the Correlated Knowledge Attack Agent (CKA-Agent), a dynamic framework that reframes jailbreaking as an adaptive, tree-structured exploration of the target model's knowledge base.
  arXiv  Detail & Related papers  (2025-12-01T07:05:23Z)
• VISION: Robust and Interpretable Code Vulnerability Detection Leveraging Counterfactual Augmentation [6.576811224645293]
  Graph Neural Networks (GNNs) can learn structural and logical code relationships in a data-driven manner.<n>GNNs often learn'spurious' correlations from superficial code similarities.<n>We propose a unified framework for robust and interpretable vulnerability detection, called VISION.
  arXiv  Detail & Related papers  (2025-08-26T11:20:39Z)
• KillChainGraph: ML Framework for Predicting and Mapping ATT&CK Techniques [0.0]
  This paper presents a phase-aware, multi-model machine learning framework that emulates adversarial behavior across the seven phases of the Cyber Kill Chain.<n>We evaluate LightGBM, a custom Transformer encoder, fine-tuned BERT, and a Graph Neural Network (GNN) to integrate their outputs through a weighted soft voting ensemble.<n>The ensemble consistently achieved the highest scores, with F1-scores ranging from 97.47% to 99.83%, surpassing GNN performance (97.36% to 99.81%) by 0.03%--0.20% across phases.
  arXiv  Detail & Related papers  (2025-08-19T14:10:01Z)
• No Query, No Access [50.18709429731724]
  We introduce the textbfVictim Data-based Adrial Attack (VDBA), which operates using only victim texts.<n>To prevent access to the victim model, we create a shadow dataset with publicly available pre-trained models and clustering methods.<n>Experiments on the Emotion and SST5 datasets show that VDBA outperforms state-of-the-art methods, achieving an ASR improvement of 52.08%.
  arXiv  Detail & Related papers  (2025-05-12T06:19:59Z)
• Cluster-Aware Attacks on Graph Watermarks [50.19105800063768]
  We introduce a cluster-aware threat model in which adversaries apply community-guided modifications to evade detection.<n>Our results show that cluster-aware attacks can reduce attribution accuracy by up to 80% more than random baselines.<n>We propose a lightweight embedding enhancement that distributes watermark nodes across graph communities.
  arXiv  Detail & Related papers  (2025-04-24T22:49:28Z)
• Unveiling Hidden Links Between Unseen Security Entities [3.7138962865789353]
  VulnScopper is an innovative approach that utilizes multi-modal representation learning, combining Knowledge Graphs (KG) and Natural Processing (NLP) We evaluate VulnScopper on two major security datasets, the National Vulnerability Database (NVD) and the Red Hat CVE database. Our results show that VulnScopper outperforms existing methods, achieving up to 78% Hits@10 accuracy in linking CVEs to Common Vulnerabilities and Exposures (CWEs), and Common Platform Languageions (CPEs)
  arXiv  Detail & Related papers  (2024-03-04T13:14:39Z)
• CVE-driven Attack Technique Prediction with Semantic Information Extraction and a Domain-specific Language Model [2.1756081703276]
  The paper introduces the TTPpredictor tool, which uses innovative techniques to analyze CVE descriptions and infer plausible TTP attacks resulting from CVE exploitation. TTPpredictor overcomes challenges posed by limited labeled data and semantic disparities between CVE and TTP descriptions. The paper presents an empirical assessment, demonstrating TTPpredictor's effectiveness with accuracy rates of approximately 98% and F1-scores ranging from 95% to 98% in precise CVE classification to ATT&CK techniques.
  arXiv  Detail & Related papers  (2023-09-06T06:53:45Z)
• G$^2$uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clustering [116.4277292854053]
  Federated Learning (FL) offers collaborative model training without data sharing. FL is vulnerable to backdoor attacks, where poisoned model weights lead to compromised system integrity. We present G$2$uardFL, a protective framework that reinterprets the identification of malicious clients as an attributed graph clustering problem.
  arXiv  Detail & Related papers  (2023-06-08T07:15:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.