TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs

• URL: http://arxiv.org/abs/2607.24563v2
• Date: Tue, 28 Jul 2026 19:41:26 GMT
• Title: TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs
• Abstract summary: TRACE-CTI is a post-extraction claim-governance framework.<n>It aggregates run-level Predictions into configuration-level GraphAssertions.<n>It materializes setup-deduplicated corroboration as ConsensusAssertions.
• Score: 4.960649631468518
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Security Operations Centers increasingly rely on automated mapping of Cyber Threat Intelligence reports to MITRE ATT&CK, yet extractor outputs remain fallible and are often stored without the evidence, provenance, and validation history needed to decide whether an individual mapping should be trusted. We present TRACE- CTI, a post-extraction claim-governance framework that preserves run-level Predictions, aggregates them into configuration-level GraphAssertions, materializes setup-deduplicated corroboration as ConsensusAssertions, and exposes only GraphAssertions backed by policy-compliant validation grounds. The framework retains native evidence granularity, complete extraction provenance, versioned trust decisions, and non-destructive revocation history. We evaluate TRACE-CTI on two public CTI corpora comprising 65 reports and 5,303 sentences, using a controlled 2 x 3 matrix of retrievers and generator families, incrementally ingested across six GraphVersions. All setups are incorporated without schema modification; provenance paths remain complete, operational scopes remain disjoint, and every trusted GraphAssertion has an active qualifying validation ground. Cross-generator-family setup pairs exhibit greater output diversity than same-family pairs. At the final graph state, increasing setup support from k >= 1 to six-setup unanimity raises gold-aligned precision from 25.3% to 90.6%, while recall decreases from 88.2% to 16.3%. The graph also directly answers seven questions about provenance, trust, versioning, dependency, disagreement, and review-queue that the evaluated minimal flat output cannot fully answer without enrichment or reprocessing. These results support explicit, auditable governance of extracted TTP claims; the observed corroboration trajectory is descriptive and does not establish statistical independence or a causal model-family effect.

Related papers

• From Transient Prompts to Persistent Control: Scientific Poster Generation via Recursive Semantic-Geometric Contracts [67.34566880931716]
  PosterVisor is a control framework that shifts poster generation from transient prompts to persistent control.<n>An Orchestrator grounds rubrics in the paper and visual assets, compiling them into a Semantic-Geometric Contract.<n>Recursive Contract Enforcement (RCE) dynamically triggers checks across stages as evidence emerges.
  arXiv  Detail & Related papers  (2026-09-15T15:32:07Z)
• ZK-Trace: Certified Collusion Tracing with Zero-Knowledge Credentials for Federated GNSS Interference Monitoring [2.611390035495907]
  ZK-Trace combines public identity marks, recipient-specific Tardos fingerprints, and zero-knowledge credential verification.<n> registry supports offline tracing without the leaker's cooperation.
  arXiv  Detail & Related papers  (2026-09-08T14:00:29Z)
• Governance at the Boundary: How Agent Decomposition Degrades Policy Compliance [6.411104724993454]
  We introduce Fiducia-bench, a benchmark for the governability of financial agents.<n>We use it to study a question no prior benchmark addresses: does an agent degrade its governance?<n>Policy-relevant facts discovered by one component are attenuated at the handoff boundary before reaching the component that must act on them.
  arXiv  Detail & Related papers  (2026-08-17T03:31:59Z)
• Independent Patch Verification for Coding Agents with a Bidirectional Reconstruct-and-Verify Framework [49.16055123488827]
  coding agents powered by large language models can now generate code patches directly from bug reports.<n>No mechanism independently verifies whether it truly resolves the reported problem.<n>We propose RETRACE, a training-free post-generation verification framework.
  arXiv  Detail & Related papers  (2026-08-09T22:59:13Z)
• Two Regimes of Chain-of-Thought Unfaithfulness: Behavioral Detection Fails Where Models Are Wrong [1.2744523252873352]
  Black-box (behavioral) detection of unfaithful CoT against FaithCoT-Bench's human annotations.<n>We find answer correctness structures the problem at every level.
  arXiv  Detail & Related papers  (2026-07-26T04:43:53Z)
• The Checking Problem: What must be true before AI ships in a regulated firm [0.0]
  Six document-heavy of the kind performed daily in regulated financial services were run across four model families and three tool families.<n>The paper computes the review burden each configuration imposes, estimated out of sample rather than with hindsight.<n>The practical implication is that the value of an AI workflow is set less by how often it is right than by how much of it a human must still check.
  arXiv  Detail & Related papers  (2026-07-25T02:35:12Z)
• Fantastic Adaptive Taxonomies and How to Use Them [100.20614173157708]
  AdaMAST converts execution traces into a compact, evidence-grounded failure taxonomy.<n>No code is hand-authored, no trace human-annotated.<n>In agent-system search, taxonomy-coded diagnoses of failed candidates outperform free-form.
  arXiv  Detail & Related papers  (2026-07-17T17:41:16Z)
• Evidence-Grounded Verified Agentic Reasoning: A Path Toward Eliminating LLM Hallucination in Empirical Inference via Tool-Attested Kernel Proofs [0.564046562677526]
  We show how a Lean 4-based tool-calling architecture can be used to govern empirical claims.<n>Every verified output structurally descends from an attested tool call and a kernel-checked chain of valid inference.<n>A formal sidecar makes the target proposition, source scope, evidence boundary, proof obligation, and abstention condition auditable.<n>Over time, typed sidecars in datasets, APIs, public records, and AI-generated documents can amortize this formalization burden into reusable infrastructure.
  arXiv  Detail & Related papers  (2026-07-14T11:33:44Z)
• SEVA: Self-Evolving Verification Agent with Process Reward for Fact Attribution [6.908637308550535]
  SEVA is a structured verification agent that emits evidence alignments, step-by-step reasoning chains, calibrated confidence, and a six-category error diagnosis.<n>On ClearFacts, SEVA-3B matches GPT-4o-mini (69.0 vs. 69.8 F1) while producing substantially richer, auditable output.
  arXiv  Detail & Related papers  (2026-06-29T02:37:13Z)
• Beyond Logprobs: A Multi-Signal Confidence Engine for LLM-Based Document Field Extraction [2.1997815944423516]
  ExtractConf is a cross-domain, field-agnostic confidence engine.<n>It grounds confidence estimation in two structurally different readings of the same document.<n>It achieves 0.928 ROC AUC and reduces selective prediction risk by 70% over logprob-mean.
  arXiv  Detail & Related papers  (2026-06-23T10:58:08Z)
• Verifier-First Evaluation of Agentic LLMs for Infrastructure-as-Code Generation [0.0]
  Infrastructure-as-Code (IaC) generation from natural language requires satisfying provider schemas, dependency planning, and organizational policy constraints.<n>We present a verifier-first empirical study of seven agentic strategies for Terraform generation evaluated on IaC-Eval v2, a modernized 186-task AWS/Terraform benchmark with Rego v1 policies.
  arXiv  Detail & Related papers  (2026-05-29T12:43:27Z)
• TRUST: A Framework for Decentralized AI Service v.0.1 [47.384270414446604]
  Large Reasoning Models (LRMs) and Multi-Agent Systems (MAS) in high-stakes domains demand reliable verification.<n>We introduce TRUST (Transparent, Robust, and Unified Services for Trustworthy AI), a decentralized framework with three innovations.<n>We prove a Safety-Profitability Theorem ensuring honest auditors profit while malicious actors incur losses.
  arXiv  Detail & Related papers  (2026-04-29T19:32:58Z)
• Claw-Eval: Toward Trustworthy Evaluation of Autonomous Agents [66.97968363332465]
  We introduce Claw-Eval, an end-to-end evaluation suite addressing all three gaps in agent benchmarks.<n>Claw-Eval comprises 300 human-verified tasks spanning 9 categories across three groups.<n>Every agent action is recorded through three independent evidence channels.
  arXiv  Detail & Related papers  (2026-04-07T17:43:18Z)
• Look As You Think: Unifying Reasoning and Visual Evidence Attribution for Verifiable Document RAG via Reinforcement Learning [55.232400251303794]
  Look As You Think (LAT) is a reinforcement learning framework that trains models to produce verifiable reasoning paths with consistent attribution.<n>LAT consistently improves the vanilla model in both single- and multi-image settings, yielding average gains of 8.23% in soft exact match (EM) and 47.0% in IoU@0.5.
  arXiv  Detail & Related papers  (2025-11-15T02:50:23Z)
• CLUE: Non-parametric Verification from Experience via Hidden-State Clustering [64.50919789875233]
  We show that correctness of a solution is encoded as a geometrically separable signature within the trajectory of hidden activations.<n>ClUE consistently outperforms LLM-as-a-judge baselines and matches or exceeds modern confidence-based methods in reranking candidates.
  arXiv  Detail & Related papers  (2025-10-02T02:14:33Z)
• AGENTICT$^2$S:Robust Text-to-SPARQL via Agentic Collaborative Reasoning over Heterogeneous Knowledge Graphs for the Circular Economy [42.73610751710192]
  AgenticT$2$S is a framework that decomposes knowledge graphs into subtasks managed by specialized agents.<n>A two-stage verifier detects structurally invalid and semantically underspecified queries.<n>Experiments on real-world circular economy KGs demonstrate that AgenticT$2$S improves execution accuracy by 17.3%.
  arXiv  Detail & Related papers  (2025-08-03T15:58:54Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.