GARAGE: Characterizing the Automation Boundary in LLM-based Attack Graph Generation

• URL: http://arxiv.org/abs/2607.18108v1
• Date: Mon, 20 Jul 2026 16:08:23 GMT
• Title: GARAGE: Characterizing the Automation Boundary in LLM-based Attack Graph Generation
• Abstract summary: Garage is a RAG-powered framework that converts fragmented CTI into an actionable domain-specific knowledge base for automated attack graph generation.<n>It synthesizes a dataset of 12,786 CVEs and 140 incident reports into a STIX 2.1 and Auto-ISAC ATM-compliant knowledge base.<n>Our 320 Leave-One-Out experiments reveal that the framework can accurately transfer security knowledge to entirely unseen vehicle architectures.
• Score: 7.155811383351991
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: While modern vehicle security depends on effective Cyber Threat Intelligence (CTI) synthesis, current automated tools struggle with unstructured data and automotive-specific architectural nuances. To bridge this gap, we introduce GARAGE, a RAG-powered framework that converts fragmented CTI into an actionable, domain-specific knowledge base for automated attack graph generation. GARAGE synthesizes a dataset of 12,786 CVEs and 140 incident reports into a STIX 2.1 and Auto-ISAC ATM-compliant knowledge base. By formalizing tactical-pattern-level scenarios through granular kill chain analysis, GARAGE achieves threat generation capabilities. Our 320 Leave-One-Out experiments reveal that the framework can accurately transfer security knowledge to entirely unseen vehicle architectures. Furthermore, we position GARAGE as a scalable TARA support tool within human-in-the-loop workflows, offering a comprehensive cost-performance analysis to guide its deployment across various LLM tiers.

Related papers

• Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilities [0.30915521808748864]
  We evaluate open-weight Large Language Models (LLMs) for generating Structured Threat Information Expression (STIX)<n>We construct a dataset called CAV-STIX that maps vulnerability descriptions to STIX domain objects (SDO), STIX objects (SRO), Common Weaknession (CWE), and MITRE ATT&CK techniques mappings.
  arXiv  Detail & Related papers  (2026-07-17T17:55:19Z)
• Process-Mining of Hypertraces: Enabling Scalable Formal Security Verification of (Automotive) Network Architectures [0.0]
  We introduce a strong, active adversary model tailored to the automotive domain.<n>We extend security protocol verification possible by introducing a verification-orchestration algorithm.<n>We present a novel integration of formal verification and process mining.
  arXiv  Detail & Related papers  (2026-04-23T12:28:28Z)
• AutoMIA: Improved Baselines for Membership Inference Attack via Agentic Self-Exploration [49.050688065974605]
  Membership Inference Attacks (MIAs) serve as a fundamental auditing tool for evaluating training data leakage in machine learning models.<n>We propose AutoMIA, an agentic framework that reformulates membership inference as an automated process of self-exploration and strategy evolution.
  arXiv  Detail & Related papers  (2026-04-01T15:17:45Z)
• Constructing Multi-label Hierarchical Classification Models for MITRE ATT&CK Text Tagging [0.0]
  We provide a "task space" characterization of the MITRE ATT&CK text tagging task.<n>We construct our own multi-label hierarchical classification models for the text tagging task.<n>Our models meet or surpass state-of-the-art performance while relying only on classical machine learning methods.
  arXiv  Detail & Related papers  (2026-01-21T00:41:34Z)
• Automating Function-Level TARA for Automotive Full-Lifecycle Security [21.31114134291877]
  This paper introduces DefenseWeaver, the first system that automates function-level TARA using component-specific details and large language models (LLMs)<n>DefenseWeaver dynamically generates attack trees and risk evaluations from system configurations described in an extended OpenXSAM++ format.<n>We validated DefenseWeaver through deployment in four automotive security projects, where it identified 11 critical attack paths.<n>In comparison to human experts, DefenseWeaver outperformed manual attack tree generation across six assessment scenarios.
  arXiv  Detail & Related papers  (2025-04-25T05:19:02Z)
• SafeAuto: Knowledge-Enhanced Safe Autonomous Driving with Multimodal Foundation Models [63.71984266104757]
  We propose SafeAuto, a framework that enhances MLLM-based autonomous driving by incorporating both unstructured and structured knowledge.<n>To explicitly integrate safety knowledge, we develop a reasoning component that translates traffic rules into first-order logic.<n>Our Multimodal Retrieval-Augmented Generation model leverages video, control signals, and environmental attributes to learn from past driving experiences.
  arXiv  Detail & Related papers  (2025-02-28T21:53:47Z)
• CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Models [49.657358248788945]
  Textual descriptions in cyber threat intelligence (CTI) reports are rich sources of knowledge about cyber threats.<n>Current CTI knowledge extraction methods lack flexibility and generalizability.<n>We propose CTINexus, a novel framework for data-efficient CTI knowledge extraction and high-quality cybersecurity knowledge graph (CSKG) construction.
  arXiv  Detail & Related papers  (2024-10-28T14:18:32Z)
• CARACAS: vehiCular ArchitectuRe for detAiled Can Attacks Simulation [37.89720165358964]
  This paper showcases CARACAS, a vehicular model, including component control via CAN messages and attack injection capabilities. CarACAS showcases the efficacy of this methodology, including a Battery Electric Vehicle (BEV) model, and focuses on attacks targeting torque control in two distinct scenarios.
  arXiv  Detail & Related papers  (2024-06-11T10:16:55Z)
• AutoAct: Automatic Agent Learning from Scratch for QA via Self-Planning [54.47116888545878]
  AutoAct is an automatic agent learning framework for QA. It does not rely on large-scale annotated data and synthetic planning trajectories from closed-source models.
  arXiv  Detail & Related papers  (2024-01-10T16:57:24Z)
• Differentiable Control Barrier Functions for Vision-based End-to-End Autonomous Driving [100.57791628642624]
  We introduce a safety guaranteed learning framework for vision-based end-to-end autonomous driving. We design a learning system equipped with differentiable control barrier functions (dCBFs) that is trained end-to-end by gradient descent.
  arXiv  Detail & Related papers  (2022-03-04T16:14:33Z)
• Towards Automated Neural Interaction Discovery for Click-Through Rate Prediction [64.03526633651218]
  Click-Through Rate (CTR) prediction is one of the most important machine learning tasks in recommender systems. We propose an automated interaction architecture discovering framework for CTR prediction named AutoCTR.
  arXiv  Detail & Related papers  (2020-06-29T04:33:01Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.