圖檢索增強威脅檢測

Computer Science > Cryptography and Security arXiv:2608.13050 (cs) [Submitted on 13 Aug 2026] Title:Operationalizing Cyber Threat Intelligence with GraphRAG Authors:Atul Kabra, Prakhar Paliwal, Manjesh K.

Hanawal View a PDF of the paper titled Operationalizing Cyber Threat Intelligence with GraphRAG, by Atul Kabra and 2 other authors View PDF HTML (experimental) Abstract:When a security researcher publishes a report on a cyberattack, detection engineers are supposed to turn it into working detection rules.

In practice, most automated attempts at this only extract the simplest clues from the report --- bad IP addresses, domain names, and file hashes --- and turn them into block lists.

This is a weak strategy, because attackers can change these simple clues within hours or days, so the resulting detections stop working almost as soon as they are deployed.Security teams describe this idea with the Pyramid of Pain.

This project asks whether feeding a report into a knowledge-graph retrieval system, Microsoft GraphRAG, rather than a standard vector-similarity retrieval system (Naive RAG), produces detection plans that rely more on these durable, top-of-pyramid clues.

Both systems are given the same report, the same generation instructions, and the same language model to write the final plan; only the retrieval step differs.

In a detailed case study of one APT28 report, the GraphRAG plan kept firing at 100\% of its detections after every IP address, domain, and file hash in the report was rotated, while the Naive RAG plan kept firing at only 29\%.

Repeating the comparison across nine real CTI reports from four vendors confirms the same pattern: GraphRAG plans consistently reach higher, harder-to-evade levels of the pyramid, even when the two systems end up close on total score.

The results support treating knowledge-graph-aware retrieval as the architecturally correct foundation for automatically generating SOC-deployable hunting plans, while showing that the wording of the generation prompt matters almost as much as the retrieval back-end itself.

Comments: 12 pages Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) Cite as: arXiv:2608.13050 [cs.CR] (or arXiv:2608.13050v1 [cs.CR] for this version) https://doi.org/10.48550/arXiv.2608.

13050 Focus to learn more arXiv-issued DOI via DataCite (pending registration) Submission history From: Manjesh Kumar Hanawal [view email] [v1] Thu, 13 Aug 2026 10:15:05 UTC (500 KB) Full-text links: Access Paper: View a PDF of the paper titled Operationalizing Cyber Threat Intelligence with GraphRAG, by Atul Kabra and 2 other authorsView PDFHTML (experimental)TeX Source view license Current browse context: cs.

CR < prev | next > new | recent | 2026-08 Change to browse by: cs cs.AI References & Citations NASA ADSGoogle Scholar Semantic Scholar export BibTeX citation Loading...BibTeX formatted citation × loading...

Data provided by: Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.

ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv (What is alphaXiv?) Links to Code Toggle CatalyzeX Code Finder for Papers (What is CatalyzeX?) DagsHub Toggle DagsHub (What is DagsHub?

) GotitPub Toggle Gotit.pub (What is GotitPub?) Huggingface Toggle Hugging Face (What is Huggingface?) ScienceCast Toggle ScienceCast (What is ScienceCast?) Demos Demos Replicate Toggle Replicate (What is Replicate?) Spaces Toggle Hugging Face Spaces (What is Spaces?) Spaces Toggle TXYZ.

AI (What is TXYZ.AI?) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower (What are Influence Flowers?) Core recommender toggle CORE Recommender (What is CORE?

) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy.arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?Learn more about arXivLabs.Which authors of this paper are endorsers?| Disable MathJax (What is MathJax?)