CTI-Thinker: an LLM-driven system for CTI knowledge graph construction and attack reasoning

Abstract With the increasing frequency of APT attacks, cyber defense urgently demands high-quality threat intelligence support. Cyber threat intelligence (CTI) knowledge graphs have demonstrated significant potential in aiding threat detection and behavioral reasoning. However, existing CTI data often suffer from unstructured formats, fragmented knowledge, a reliance on manual annotation, and limited semantic mapping to attack techniques. These limitations hinder the robustness and accuracy of downstream reasoning tasks (e.g., attack attribution and intent inference). Moreover, traditional information extraction methods struggle to generalize in scenarios involving cross-paragraph dependencies, emerging…

• NS
  National Science Foundation
• NN
  National Natural Science Foundation of China

  Awards: 62172308, 72261004, 62202118
• GU
  Guizhou University
• JP
  Jilin Province Key R&D Plan Project

  Award: PA[2025]004
• MS
  Major Scientific and Technological Special Project of Guizhou Province