Abstract:Textual descriptions in cyber threat intelligence (CTI) reports, such as security articles and news, are rich sources of knowledge about cyber threats, crucial for organizations to stay informed about the rapidly evolving threat landscape. However, current CTI extraction methods lack flexibility and generalizability, often resulting in inaccurate and incomplete knowledge extraction. Syntax parsing relies on fixed rules and dictionaries, while model fine-tuning requires large annotated datasets, making both paradigms challenging to adapt to new threats and ontologies. To bridge the gap, we propose CTINexus, a novel framework leveraging optimized in-context learning (ICL) of large language models (LLMs) for data-efficient CTI knowledge extraction and high-quality cybersecurity knowledge graph (CSKG) construction. Unlike existing methods, CTINexus requires neither extensive data nor parameter tuning and can adapt to various ontologies with minimal annotated examples. This is achieved through (1) a carefully designed automatic prompt construction strategy with optimal demonstration retrieval for extracting a wide range of cybersecurity entities and relations; (2) a hierarchical entity alignment technique that canonicalizes the extracted knowledge and removes redundancy; (3) an ICL-enhanced long-distance relation prediction technique to further complete the CKSG with missing links. Our extensive evaluations using 150 real-world CTI reports collected from 10 platforms demonstrate that CTINexus significantly outperforms existing methods in constructing accurate and complete CSKGs, highlighting its potential to transform CTI analysis with an efficient and adaptable solution for the dynamic threat landscape.

TSEE: a novel knowledge embedding framework for cyberspace security

A Confidence-Aware Machine Learning Framework for Dynamic Security Assessment

MetaSensing in Metaverses: See There, Be There, and Know There

SecTKG: A Knowledge Graph for Open-Source Security Tools.

Recent Progress of Using Knowledge Graph for Cybersecurity

Embedding Ontologies via Incorporating Extensional and Intensional Knowledge

Data-Driven Cybersecurity Knowledge Graph Construction for Industrial Control System Security

CTINEXUS: Leveraging Optimized LLM In-Context Learning for Constructing Cybersecurity Knowledge Graphs Under Data Scarcity

SoK: Unifying Cybersecurity and Cybersafety of Multimodal Foundation Models with an Information Theory Approach

A Novel Threat Intelligence Information Extraction System Combining Multiple Models

Network Security Situation Awareness System Based on Knowledge Discovery

KnowCTI: Knowledge-based Cyber threat intelligence entity and relation extraction

STGE: Sensor Topology and Graph Embedding Learning with Heterogeneous Smart Environment

An integrated deep-learning and multi-level framework for understanding the behavior of terrorist groups

MATHEMATICS OF SENSING, EXPLOITATION, AND EXECUTION (MSEE) Sensing, Exploitation, and Execution (SEE) on a Foundation for Representation, Inference, and Learning

K-CTIAA: Automatic Analysis of Cyber Threat Intelligence Based on a Knowledge Graph

A System for Automated Open-Source Threat Intelligence Gathering and Management

SEEK: Segmented Embedding of Knowledge Graphs

Framework for Risk Assessment in Cyber Situational Awareness

OntoCSD: an ontology-based security model for an integrated solution of cyberspace defense

Artificial Intelligence Enabled Cyber Security Defense for Smart Cities: A Novel Attack Detection Framework Based on the MDATA Model