Title: LLM4CTI: Uncovering Security Entities and Their Interactions from Unstructured Cyber Threat Intelligence
Primary area: other topics in machine learning (i.e., none of the above)
Keywords: cyber threat intelligence, knowledge graph, large language model, cybersecurity, graph neural networks

Abstract: Unstructured Cyber Threat Intelligence (CTI) articles are a critical source of detailed threat knowledge. Structuring this information into knowledge graphs is crucial for downstream applications, including enhancing Large Language Models (LLMs) factuality and enabling advanced predictive analysis. However, extracting security-related knowledge from these long articles poses a fundamental dilemma for LLMs: capturing relationships scattered across distant sentences requires full-article context, yet processing long inputs triggers issues like the “lost in the middle” phenomenon, while naive chunking severs these crucial long-range dependencies. To resolve this dilemma, we present LLM4CTI, an approach that employs a novel dual-context, chunk-wise processing pipeline. For each text chunk, LLM4CTI provides the LLM with both the local chunk for fine-grained analysis and the full article for global context. A formal, security-oriented framework further guides the LLM to focus on threat-relevant information. Evaluation shows that LLM4CTI achieves a state-of-the-art F1-score of 85.13%. This is driven by an average recall of 81.58%, substantially outperforming competitors like CTINexus (65.97%), CTIKG (76.73%), and GraphRAG (70.25%), while maintaining a high precision of 89.87%. Notably, the version of LLM4CTI powered by a local 32B open-source model also achieves a strong F1-score of 81.58%, surpassing baselines that rely on the much larger GPT-4o. Furthermore, LLM4CTI’s integrated GNN leverages the extracted knowledge to deliver predictive insights. It successfully forecasts relationships between threat-related entities, such as connections between malware families, with over 80% Hits@10 accuracy.