analiza aiqbench
AHLERT addresses the scalability bottleneck in threat hunting by automatically converting unstructured Cyber Threat Intelligence reports into actionable, environment-aware hypotheses. The system leverages a hybrid retriever combining dense vector search with MITRE ATT&CK knowledge graphs to significantly outperform flat-RAG baselines in generating investigable leads. This research demonstrates how retrieval-augmented generation can be effectively constrained to specific operational contexts for security applications.
Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports
arXiv:2609.08790v1 Announce Type: cross Abstract: Threat hunting increasingly depends on converting unstructured knowledge (e.g., Cyber Threat Intelligence reports) into actionable hunt leads: concise, investigable hypotheses grounded in observable artifacts and adversary techniques. Producing such leads manually is a tedious and hard-to-scale task. Existing automated approaches stop at the entity layer, ignore the defender's operational environment, and analyze each report in isolation. To address these gaps, we introduce AHLERT, a system that automatically extracts relevant, environment-aware, and hunt leads from threat reports through (i) a hybrid retriever that combines dense vector search with multi-hop traversal over a knowledge graph seeded with MITRE ATT&CK; (ii) an ontology-grounding retrieval-augmented generation method that constrains each lead to the defender's own assets and controls; and (iii) an LLM-agnostic framework that emits structured, directly actionable leads rather than loose indicators of compromise. We evaluate AHLERT on public CTI reports for well-known APTs across multiple proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 by ~2x (0.44 to 0.85) over a single-route flat-RAG baseline, and AHLERT attains the highest effectiveness score (~86.95%) compared with off-the-shelf LLM models.
Abstract:Threat hunting increasingly depends on converting unstructured knowledge (e.g., Cyber Threat Intelligence reports) into actionable hunt leads: concise, investigable hypotheses grounded in observable artifacts and adversary techniques. Producing such leads manually is a tedious and hard-to-scale task. Existing automated approaches stop at the entity layer, ignore the defender's operational environment, and analyze each report in isolation. To address these gaps, we introduce AHLERT, a system that automatically extracts relevant, environment-aware, and hunt leads from threat reports through (i) a hybrid retriever that combines dense vector search with multi-hop traversal over a knowledge graph seeded with MITRE ATT&CK; (ii) an ontology-grounding retrieval-augmented generation method that constrains each lead to the defender's own assets and controls; and (iii) an LLM-agnostic framework that emits structured, directly actionable leads rather than loose indicators of compromise. We evaluate AHLERT on public CTI reports for well-known APTs across multiple proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 by ~2x (0.44 to 0.85) over a single-route flat-RAG baseline, and AHLERT attains the highest effectiveness score (~86.95%) compared with off-the-shelf LLM models.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2609.08790 [cs.CR]
(or arXiv:2609.08790v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.08790 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Text integral sub licența deschisă a publicației · 277 cuvinte
Subiecte conexe
The standard for agents you can trust: Lessons from the federal front lines
Snorkel AI Blog · 5 iun. 2026
[AINews] not much happened today
Latent Space · 10 sept. 2026
Building an Enterprise AI Customer Support Platform with Claude Fable 5.1 and Claude Code
Analytics Vidhya · 5 oct. 2026
Explainable AML Triage with LLMs: Evidence Retrieval and Counterfactual Checks
arXiv · 9 iun. 2026