Threat-hunting-oriented attack graph construction using fine-tuned large language model
Zhaoyun LIU , Kaijie ZHU , Di CHEN , Ding LI , Zheng GAO , Jinlong FEI
Cyber threat hunting, which aims to proactively search for malicious behaviors in victim systems, plays an important role in modern cybersecurity. Attack graphs constructed from cyber threat intelligence (CTI) present structured knowledge and direct views of attack campaigns. This representation has been considered promising ground for threat hunting. However, automatically transforming narrative reports into accurate and practical attack graphs remains a significant challenge. Existing methods generally fail to precisely understand professional cybersecurity knowledge and bridge the semantic gap between natural language and system audit logs. Besides, incomplete narratives in reports might lead to fragmented topology in the produced graphs. These drawbacks have impeded the practical applications of their constructed attack graphs. In this study, we propose MERCATOR, a novel pipeline that leverages cybersecurity-adapted large language models (LLMs) for attack graph construction. MERCATOR incorporates Chain-of-Thought (CoT) reasoning with fine-tuned LLMs to accurately extract threat elements and align high-level interactions with system-level events. To solve the topology fragmentation problem, we further leverage tactical stage information to restore missing connections between fragmented subgraphs. Experimental results demonstrate that MERCATOR produces more accurate (0.821, 0.855, and 0.837 for precision, recall, and F1-score) and comprehensive attack graphs, which provide more reliable guidance to modern threat hunting algorithms.
cyber threat intelligence / attack graph construction / advanced persistent threat / large language models / cyber threat hunting
Higher Education Press 2026
/
| 〈 |
|
〉 |
PDF
(14472KB)
