New LLM framework BEACON constructs cyber threat intelligence knowledge graphs

Researchers have developed BEACON, a new framework that uses LLMs to construct knowledge graphs from cyber threat intelligence (CTI) reports. This approach anchors extracted information to standardized attack behaviors from MITRE ATT&CK, enabling the consolidation of data from disparate sources that may use different naming conventions for the same threats. BEACON's two-stage process, which includes a propose-then-verify paradigm and a hierarchical alignment strategy, aims to reduce LLM misclassification and hallucination. To evaluate BEACON, two new datasets were created, and the framework demonstrated superior performance over existing methods. AI

IMPACT This research could improve the efficiency and accuracy of cyber threat analysis by enabling better consolidation of intelligence from diverse sources.

RANK_REASON The item describes a research paper detailing a new framework and methodology for constructing knowledge graphs from cyber threat intelligence. [lever_c_demoted from research: ic=1 ai=1.0]

Read on arXiv cs.CL →

• alphaXiv
• arXiv
• BEACON
• CatalyzeX
• Connected Papers
• Cyber threat intelligence
• DagsHub
• Gotit.pub
• Hugging Face
• Knowledge graph
• Litmaps
• LLM
• MITRE ATT&CK
• ScienceCast
• scite Smart Citations

• paper
• other

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →