TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction
2026-07-06 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceMachine LearningMultiagent Systems
AI summaryⓘ
The authors address the problem of turning messy cybersecurity reports into neat, structured knowledge graphs that computers can easily use. Instead of using one big language model to do everything, they split the work into smaller, specialized AI agents that handle specific tasks like finding key info, labeling it, checking accuracy, and organizing it. This new approach, called TACTIC-KG, uses smaller models, making it cheaper and more reliable. Testing on real cybersecurity reports showed it performed better than other top methods in accurately extracting and organizing information.
Cyber Threat Intelligence (CTI)Cybersecurity Knowledge Graph (CSKG)Large Language Models (LLMs)Information ExtractionEntity TypingGraph ConstructionAgent-based SystemsIn-context Learning (ICL)F1-scoreKnowledge Representation
Authors
Mouhamed Amine Bouchiha, Gregory Blanc
Abstract
Cyber Threat Intelligence (CTI) reports are predominantly unstructured, heterogeneous, and noisy, which limits their direct usability for automated analysis and reasoning. Cybersecurity Knowledge Graphs (CSKGs) provide a structured representation of adversarial entities, actions, and relations, but constructing such graphs from free-text CTI remains a challenge. Recent approaches rely on monolithic Large Language Models (LLMs) to perform end-to-end extraction and completion, leading to high cost, limited controllability, and unstable performance. This paper introduces TACTIC-KG, an agentic framework for CSKG construction that decomposes the task into modular, specialized LLM agents responsible for extraction, typing, verification, and curation. Using lightweight models (3B--8B), TACTIC-KG improves stability, recall, and graph consistency while reducing deployment cost. We implement and evaluate TACTIC-KG against recent state-of-the-art systems. Experiments on human-annotated CTI reports show that agent specialization consistently outperforms larger monolithic in-context-learning (ICL) baselines in extraction F1-score, typing accuracy, and structural graph similarity.