TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs
2026-07-27 • Artificial Intelligence
Artificial IntelligenceCryptography and Security
AI summaryⓘ
The authors developed TRACE-CTI, a system that helps organize and check claims made by automated tools mapping Cyber Threat Intelligence reports to the MITRE ATT&CK framework. It keeps detailed evidence and history for each claim, allowing users to see which claims are trustworthy based on how many tools agree and follow validation rules. Their tests showed that requiring agreement from multiple tools increases the confidence in correct claims but reduces how many claims are found overall. The system also provides answers to questions about the origin, trust, and review status of claims, which simple outputs cannot do. This helps security teams better manage and verify automated threat information.
Cyber Threat IntelligenceMITRE ATT&CKSecurity Operations Centerclaim governanceextraction provenancevalidation groundsprecision and recallGraphAssertionsconsensusTTP claims
Authors
Federico Valletta, Giacomo Longo, Enrico Russo, Alessio Merlo
Abstract
Security Operations Centers increasingly rely on automated mapping of Cyber Threat Intelligence reports to MITRE ATT&CK, yet extractor outputs remain fallible and are often stored without the evidence, provenance, and validation history needed to decide whether an individual mapping should be trusted. We present TRACE- CTI, a post-extraction claim-governance framework that preserves run-level Predictions, aggregates them into configuration-level GraphAssertions, materializes setup-deduplicated corroboration as ConsensusAssertions, and exposes only GraphAssertions backed by policy-compliant validation grounds. The framework retains native evidence granularity, complete extraction provenance, versioned trust decisions, and non-destructive revocation history. We evaluate TRACE-CTI on two public CTI corpora comprising 65 reports and 5,303 sentences, using a controlled 2 x 3 matrix of retrievers and generator families, incrementally ingested across six GraphVersions. All setups are incorporated without schema modification; provenance paths remain complete, operational scopes remain disjoint, and every trusted GraphAssertion has an active qualifying validation ground. Cross-generator-family setup pairs exhibit greater output diversity than same-family pairs. At the final graph state, increasing setup support from k >= 1 to six-setup unanimity raises gold-aligned precision from 25.3% to 90.6%, while recall decreases from 88.2% to 16.3%. The graph also directly answers seven questions about provenance, trust, versioning, dependency, disagreement, and review-queue that the evaluated minimal flat output cannot fully answer without enrichment or reprocessing. These results support explicit, auditable governance of extracted TTP claims; the observed corroboration trajectory is descriptive and does not establish statistical independence or a causal model-family effect.