Research on knowledge graph construction technology for cyber threat intelligence based on large language models - LAI Qingnan; JIN Jiandong; ZHOU Changling (Tongxin xuebao)
As the complexity and sophistication of cyber threats continue to increase, integrating cyber threat intelligence into cybersecurity measures has become crucial. A framework called AutoCTI2KG was proposed, which was based on large language models for constructing cyber threat intelligence knowledge graphs. Through instruction prompts and context learning, AutoCTI2KG automatically generated cybersecurity and attack knowledge graphs from cyber threat intelligence and provided actionable defense recommendations. Experimental results show that the proposed framework performs excellently in constructing cybersecurity and attack knowledge graphs, with F1 scores around 0.90, demonstrating the potential of large language models in knowledge graph construction in the cybersecurity domain. This work not only advances the frontier of cybersecurity knowledge graph construction but also provides a practical tool for cybersecurity professionals to better understand and mitigate cyber risks.