Security teams have long faced a stubborn problem: the intelligence that best describes how attackers operate — detailed, narrative-rich Cyber Threat Intelligence reports — exists in a form that computers cannot easily reason over. A new automated framework, detailed in a research paper published on arXiv, takes direct aim at that gap by turning unstructured threat narratives into machine-readable cyber threat attack chains that a logical inference engine can actually traverse.
Summary
Key takeaways
- CTI reports describe real-world attacks in narrative form but cannot be directly used for automated attack-path reasoning.
- The framework models each attack step as an attack unit — a structured triple of preconditions, attack behavior, and postconditions.
- A multi-stage pipeline powered by large language models extracts, normalizes, and repairs these units from raw CTI text.
- On 20 CTI reports containing 334 human-validated steps, Datalog inference successfully reached the specified attack goal in 19 out of 20 reports, and backward search uncovered 34 attack paths.
- The framework outperforms both representative CTI extraction systems and end-to-end LLM baselines on coverage, completeness, and consistency.
Challenges in Extracting Structured Knowledge from CTI Reports
Threat intelligence reports are some of the most information-dense documents in cybersecurity. They capture attacker tooling, lateral movement techniques, privilege escalation sequences, and final objectives — often written by analysts who witnessed a breach unfold in real time. But that richness comes at a cost: the knowledge is buried inside free-form prose, not structured data.
That unstructured nature makes automated CTI extraction genuinely hard. A human analyst reads a report and mentally constructs a timeline of what happened. An automated system has no equivalent shortcut. It cannot trivially infer that step three only became possible because step two established a particular system state.
What current extraction tools miss
Most existing approaches to CTI extraction focus on pulling out indicators of compromise — IP addresses, file hashes, domain names — or on tagging tactics, techniques, and procedures against frameworks like MITRE ATT&CK. These outputs are useful, but they are essentially flat. They tell you what happened without encoding why one action enabled the next.
The core limitation is the absence of execution conditions. Without knowing what state the system was in before an attacker ran a command, and what state it was in afterward, you cannot chain steps together into a coherent attack path. State matching and reachability analysis — the operations that would let a defender ask “can the attacker actually reach this goal from this starting point?” — are simply not supported by label-level extraction.
The Proposed Automated Framework for Attack Chain Extraction
The research introduces a framework that reframes the extraction problem around a richer unit of analysis. Rather than extracting individual indicators or TTP labels, it models each step of an attack as an attack unit: a structured object consisting of preconditions, an attack behavior, and postconditions. Preconditions capture what must be true about the environment before the step executes. Postconditions capture what becomes true afterward. Together, they make it possible to reason about whether one step can feed into the next.
Multi-stage extraction pipeline assisted by large language models
Constructing these attack units from raw text is where large language models enter the picture — not as a single end-to-end generator, but as components in a multi-stage attack analysis pipeline. The pipeline works in sequence: first extracting attack behavior skeletons from the CTI narrative, then recovering the preconditions and postconditions for each behavior, then normalizing all components into a predefined set of predicates, and finally repairing any broken dependencies that would disconnect the chain.
That last repair step is analytically significant. Real CTI reports are not written as engineering specifications. Authors omit assumptions they consider obvious, skip intermediate steps, or describe effects without naming causes. A system that does not actively patch these gaps will produce attack chains full of logical holes — sequences that look complete on the surface but cannot actually be traversed. The repair stage addresses this directly.
The result of the full pipeline is a set of attack units that are normalized and internally consistent — ready to be handed off to a reasoning engine rather than simply catalogued.
Logical Reasoning and Evaluation Outcomes
Once extracted, the attack units are compiled into Datalog-style rules. Datalog is a logic programming language well suited to reachability queries: given a set of facts and rules, can the system derive that a specified goal state is reachable? Framing attack chains this way transforms a knowledge extraction problem into a formal reasoning problem — one with a clear success criterion.
Compilation into Datalog-style rules for reachability analysis
Each attack unit becomes a rule: if the preconditions hold, then the postconditions follow. Chaining these rules together allows the inference engine to ask whether a specific attack objective — say, full domain compromise — is reachable from an initial foothold, given the behaviors described in the CTI report. This is a materially different capability from knowing that a given TTP was observed. It is the difference between a list of ingredients and a recipe with a verified outcome.
Performance on annotated CTI reports
The evaluation dataset consisted of 20 CTI reports containing 334 human-validated annotated steps. Across that dataset, the framework achieved higher annotated-step coverage than representative CTI extraction systems — meaning it recovered more of the attack behaviors that human analysts had identified as significant.
The Datalog inference engine reached the specified attack goal in 19 of the 20 reports. Backward search across the generated rule sets yielded 34 distinct attack paths. That last figure matters: finding multiple paths to the same goal reveals redundancy in attacker strategy and gives defenders a more complete picture of where they need to close gaps.
Comparative advantages over end-to-end LLM baselines
Comparing against end-to-end large language model baselines — where a single model is prompted to produce the full attack unit in one shot — the structured pipeline produced attack units that were measurably more complete and more consistent. End-to-end generation tends to produce plausible-looking output that nonetheless drops preconditions or generates postconditions that contradict earlier steps. The staged approach, by contrast, forces each component to be extracted and normalized separately before being assembled, which reduces drift and omission.
This is the deeper methodological insight embedded in the research. Large language models are powerful extractors of semantics from unstructured text, but they are not reliable architects of logical structure when left to their own devices. Wrapping them inside a disciplined pipeline — where each stage has a specific, bounded task — appears to recover the consistency that unconstrained generation loses.
Why This Matters for Threat Intelligence and Defense
The practical implication is that defenders could, in principle, feed a newly published CTI report into a system like this and receive not just a summary of attacker behavior but a machine-verified answer to the question: given this reported technique sequence, can the adversary reach our crown jewels from a given entry point? That kind of attack-goal reachability analysis has historically required skilled analysts to perform manually — a slow, expensive process that does not scale to the volume of threat intelligence organizations receive.
There is also a broader signal here about the role of structured reasoning in AI-assisted security. As organizations integrate large language models into their security operations, the temptation is to treat them as universal solvers. The results of this research suggest a more nuanced picture: LLMs paired with formal inference engines may be more powerful than either alone, precisely because they compensate for each other’s weaknesses. The source code and experimental artifacts are available in an anonymized repository, leaving the door open for independent validation and extension.
FAQ
Why is extracting attack chains from CTI reports challenging?
CTI reports are unstructured narratives describing real-world attacks, which makes it difficult to automate attack-path reasoning. The prose omits assumptions, skips intermediate steps, and does not encode the system states that determine whether one attack step can follow another.
How does the proposed framework improve over existing CTI extraction methods?
It models each attack step with preconditions, behavior, and postconditions, and uses a multi-stage language model pipeline to extract and normalize these components — including a repair stage that patches broken dependencies. This enables state matching and reachability reasoning that label-level extraction methods cannot support.
What role does Datalog inference play in this framework?
Extracted attack units are compiled into Datalog-style rules, allowing the system to perform reachability reasoning and identify attack paths leading to specified goals. This transforms extracted knowledge into a formally verifiable claim about what an attacker can achieve.
How was the framework’s performance evaluated?
On 20 CTI reports containing 334 human-validated annotated steps, the framework achieved higher coverage than representative CTI extraction systems and produced more complete attack units than end-to-end LLM baselines. Datalog-based reachability analysis succeeded in 19 of the 20 reports, and backward search identified 34 distinct attack paths.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
