Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports
AHLERT generates environment-aware threat hunting leads from CTI reports using ATT&CK-seeded knowledge graph retrieval, roughly doubling F1 over flat-RAG baselines.
The paper introduces AHLERT, a system that converts Cyber Threat Intelligence reports into structured, investigable hunt leads via hybrid dense retrieval with multi-hop traversal over an MITRE ATT&CK-seeded knowledge graph and ontology-grounded RAG constrained to the defender's assets. It is LLM-agnostic and evaluated on public CTI reports for well-known APTs across proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 from 0.44 to 0.85, and AHLERT attains the highest effectiveness score (~86.95%) versus off-the-shelf LLMs.
- Hybrid dense retrieval plus multi-hop graph traversal seeded with MITRE ATT&CK
- Ontology grounding constrains leads to the defender's own assets and controls
- Mean F1 rises from 0.44 to 0.85 versus flat-RAG baseline
- Achieves ~86.95% effectiveness across proprietary and open-weight LLMs
- Vendors
- MITRE
- Products
- MITRE ATT&CKAHLERT
- Organizations
- MITRE
From the original article
1 min read at arxiv.orgThreat hunting increasingly depends on converting unstructured knowledge (e. g. , Cyber Threat Intelligence reports) into actionable hunt leads: concise, investigable hypotheses grounded in observable artifacts and adversary techniques.
By Akash Prakash · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.