Summary
When protecting computers from hackers, it's hard to understand how an attack really happens because the clues come from many different sources and are often incomplete. This paper presents a method that automatically puts these clues together into a clear, step-by-step map of an attack showing what must happen and what signs it leaves behind. The authors use a special technique combining retrieval and language models to fill in missing details and organize the information. This helps security teams to better prevent, detect, and respond to attacks by seeing the full picture in one place. They tested their method on 10 real examples and found it matches what experts expect about how attacks progress.
cyber threat intelligenceattack graphindicators of compromiseretrieval-augmented generationsmall language modelscybersecurityphishingbackdoorsstaged downloadersoperational details
Authors
Nicola Deidda, Leonardo Regano, Alessandro Sanna, Davide Maiorca, Giorgio Giacinto
Abstract
Modern cybersecurity operations rely on CTI collected from heterogeneous sources, including semi-structured threat representations, IoCs, and narrative technical reports. However, these artifacts are often insufficient in isolation to reconstruct how an attack unfolds, under which conditions each step is feasible, and which traces it leaves behind. In practice, analysts must manually correlate partial evidence scattered across multiple and only partially structured sources, delaying the design of effective prevention, detection, and response actions. To address this gap, we propose an automated pipeline that derives an actionable representation of a cyberattack from heterogeneous CTI sources. The pipeline combines a RAG architecture with a locally deployable SLM, used to consolidate such evidence and infer missing operational details. Starting from a semi-structured threat representation and auxiliary CTI documents, the pipeline produces an enriched Attack Graph that captures a coarse, tactic-aligned progression of the attack and annotates each step with explicit pre-conditions and post-conditions, and an enriched description. This representation supports prevention by exposing execution requirements, detection by highlighting observable traces, and response by clarifying the temporal progression of the attack. Then, due to the lack of validated datasets with ground-truth information on the temporal evolution of real-world attacks, we test the complete pipeline on 10 real-world case studies spanning multiple threat types, including backdoors and staged downloaders delivered via phishing. A manual assessment across 10 real-world case studies provides initial evidence that the generated graphs are consistent with expected attack progressions, indicating that the proposed approach can support analysts by consolidating dispersed CTI evidence into a structured and actionable view of attacks.