💻 computer science

An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

This paper proposes an automated framework that leverages large language models to extract structured attack units with preconditions and postconditions from unstructured Cyber Threat Intelligence reports, compiling them into Datalog rules to enable effective reachability analysis and multi-stage attack chain reasoning.

Original authors: Wenbo Hou, Ning Hu, Xueping Wang, Jiahao Gu, Wenjian Luo

Published 2026-07-23

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Wenbo Hou, Ning Hu, Xueping Wang, Jiahao Gu, Wenjian Luo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling city where bad actors are constantly trying to sneak into buildings, steal keys, and unlock doors. To stop them, security experts write detailed stories called "Cyber Threat Intelligence" reports. These stories describe exactly how a hacker broke in: "First, they sent a fake email. Then, the victim clicked a link. Next, a virus downloaded itself." It's like a detective's case file. But here's the problem: these stories are written in messy, human language. A computer trying to read them gets confused. It can't easily figure out why step two happened (it needed step one to finish first) or what changed in the system after step two. It's like trying to build a working robot using only a pile of unsorted recipe cards; you know the ingredients, but you don't know the order or the cause-and-effect.

To fix this, researchers need a way to turn those messy stories into a strict, logical blueprint that a computer can actually run. They need to know not just what the hacker did, but what conditions had to be true for the hacker to do it (the "preconditions") and what new state the system was left in afterward (the "postconditions"). Think of it like a board game: you can't move your piece to a new square unless you have the right dice roll (the condition), and once you move, your piece is now in a new spot (the result). If you can translate a hacker's story into a perfect set of game rules, you can ask the computer, "Can a hacker get from the front door to the vault?" and get a definite answer. This is the challenge this paper tackles: turning vague spy stories into a precise, playable game of cyber defense.

The authors of this paper built a clever, automated framework to solve this puzzle. They realized that simply asking a smart computer program (a Large Language Model) to "read the story and give me the rules" doesn't work well. If you just ask for the whole thing at once, the computer often gets the details wrong, mixes up the order, or invents steps that don't actually exist. It's like asking a student to write a whole essay in one breath; they might miss the logic. Instead, the researchers designed a multi-stage assembly line.

First, the system acts like a careful editor, pulling out the main "attack moves" from the text, like "download file" or "bypass firewall." Then, it acts like a detective, hunting down the specific clues that explain why that move was possible and what happened next. But here's the magic: it doesn't leave those clues as messy sentences. It forces them into a strict, standardized code, like translating "the computer is open to the internet" into a specific game token called network.open. This is crucial because it lets the computer check if the "tokens" match up perfectly. If the first move leaves a "door open" token, the next move can only happen if it needs a "door open" token.

The system even has a "quality control" stage. It runs a simulation to see if the chain of moves actually connects from start to finish. If it finds a broken link—like a step that needs a "password" token that was never created—it stops and tries to fix it, or at least flags the error. Finally, it compiles all these clean, verified steps into a set of logical rules (using a language called Datalog) that a computer can instantly run to see if a specific attack goal is reachable.

When they tested this on 20 real-world cyber attack reports containing 334 specific steps, the results were impressive. Their method found and correctly formatted 94.9% of the attack steps, beating other existing tools that only managed around 80% or less. More importantly, when they let their computer run the logic on these extracted rules, it successfully figured out how to reach the hacker's goal in 19 out of the 20 reports. This proves that their "assembly line" approach is much better at turning messy human stories into clean, playable game rules than just asking a smart AI to guess the whole thing at once. They didn't just find the steps; they built a bridge that lets computers actually understand the logic of an attack, turning a static story into a dynamic map of danger.

Technical Summary: An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

Problem Statement

Cyber Threat Intelligence (CTI) reports contain rich, detailed narratives of real-world attack processes, ranging from initial compromise to final objectives. However, these reports are written in unstructured natural language, mixing attack actions, contextual evidence, and technical details across paragraphs. While human analysts can mentally reconstruct attack chains, automated systems struggle to transform these narratives into a representation suitable for formal reasoning.

Current CTI extraction methods suffer from two primary limitations:

Representation Gap: Existing methods focus on extracting Indicators of Compromise (IOCs), flat MITRE ATT&CK labels, or entity-relation graphs. These outputs lack explicit preconditions (the state required to execute a step) and postconditions (the resulting security state). Consequently, the extracted knowledge is descriptive rather than executable; it cannot support state matching, dependency verification, or attack-goal reachability analysis.
Extraction Gap: A naive approach of prompting Large Language Models (LLMs) to generate complete precondition-behavior-postcondition chains end-to-end is unreliable. Such generation often produces conditions in open-ended natural language (hindering symbolic reasoning), misses implicit dependencies scattered across the text, suffers from inconsistent granularity, and lacks mechanisms to verify if generated steps form a connected, executable derivation.

Methodology

The paper proposes a multi-stage, LLM-assisted framework designed to bridge the gap between unstructured CTI narratives and formal, logic-based attack reasoning. The framework operates in two phases: CTI-to-Attack-Unit Repository Construction and Repository-Based Attack Path Reasoning.

1. Attack Unit Representation

The core innovation is modeling each attack step as an Attack Unit:
$u_j = \langle Pre_j, Act_j, Post_j \rangle$

Preconditions ( $Pre_j$ ): Environmental states, user actions, or prior attack states required before execution.
Attack Behavior ( $Act_j$ ): The core action (e.g., download, execute).
Postconditions ( $Post_j$ ): The new security states produced after execution.

These units are compiled into Datalog-style rules where preconditions form the rule body and postconditions form the rule head, enabling logical inference engines (like MulVAL) to determine reachability.

2. The Extraction Pipeline

To address the extraction gap, the framework replaces single-pass generation with a controlled, multi-stage pipeline:

Behavior Skeleton Extraction: The framework identifies an ordered sequence of attack behaviors. To ensure consistent granularity, it utilizes a Behavior Vocabulary (derived from MITRE ATT&CK and common CTI semantics) to classify actions (e.g., user_action, download, execute), preventing over-compression or over-fragmentation.
Pre/Postcondition Extraction: A dual-channel strategy is employed. A local channel focuses on immediate textual evidence and neighboring steps, while a global channel analyzes the full report to capture long-range dependencies. Outputs from both channels are fused to generate candidate conditions.
Predicate Normalization: Natural language conditions are mapped to a predefined Predicate Vocabulary (following MulVAL-style semantics). This converts free-text into symbolic states (e.g., host.vuln_present(host, CVE)), ensuring that postconditions of one unit can exactly match the preconditions of another.
Diagnosis-Guided Repair: An LLM inspects the normalized chain to identify inconsistencies, such as unsupported preconditions (states not produced by prior steps or initial facts), mismatched predicates, or incorrectly merged branches. The system strictly repairs only flagged issues to maintain fidelity to the source report.
Rule Generation & Reasoning: The normalized units are converted into Datalog rules. A forward-chaining algorithm determines if an attack goal is reachable from an initial fact set ( $F_0$ ), and backward search recovers the specific attack paths.

Key Contributions

Reasoning-Ready Representation: The paper introduces a representation that models attack steps as executable state transitions ( $Pre \to Act \to Post$ ) rather than descriptive records. This enables state matching and dependency verification, which were previously impossible with standard CTI extractions.
Reliable Extraction Framework: By decomposing the extraction task into controllable stages (skeleton extraction, condition recovery, normalization, and repair), the framework overcomes the unreliability of end-to-end LLM generation. It stabilizes step granularity and enforces dependency consistency.
Bridge from Text to Formal Logic: The framework automatically generates the Datalog rules traditionally requiring expert hand-writing, allowing logical attack-graph analyzers to utilize narrative CTI reports directly.
Empirical Validation: The approach is evaluated on 20 CTI reports containing 334 human-validated annotated steps, demonstrating superior performance in step coverage and reasoning readiness compared to existing systems.

Experimental Results

The framework was evaluated against three representative CTI extraction systems (AttacKG+, CRUcialG, and CTINEXUS) and internal ablation variants.

Attack-Step Coverage: The proposed framework achieved a 94.9% macro-average Step Coverage on the 334 annotated steps, significantly outperforming CTINEXUS (82.2%), AttacKG+ (81.1%), and CRUcialG (42.6%). It fully covered 300 steps, partially covered 32, and missed only 2.
Predicate Accuracy: The framework achieved an average Predicate F1 score of 80.9% (Precision: 85.3%, Recall: 77.8%) across the 20 reports. This indicates high accuracy in recovering both the conditions required for execution and the resulting security states.
Reasoning Success: On the extracted chains, Datalog inference successfully reached the specified attack goal in 19 out of 20 reports. Backward search recovered a total of 34 attack paths.
Ablation Study: Removing the multi-stage pipeline in favor of end-to-end generation (using GPT-4.1 or GPT-5.2) resulted in a drastic drop in performance (average F1 dropped from 94.5% to ~50%), confirming that the staged approach with vocabulary constraints and repair mechanisms is critical for precision.

Significance and Claims

The paper claims that its primary significance lies in transforming unstructured CTI narratives into structured, executable knowledge. By explicitly modeling preconditions and postconditions, the framework enables automated systems to perform reachability analysis and attack-path reasoning—tasks that were previously limited to manual analysis or required hand-crafted rules.

The authors emphasize that while the framework successfully bridges the gap between narrative reports and formal reasoning, it is not a perfect solution. Limitations include:

Dependence on expert-designed vocabularies.
Challenges in distinguishing static environmental assumptions (e.g., existing network connectivity) from dynamically produced attack states.
Occasional difficulties in handling reports that aggregate multiple distinct campaign contexts into a single narrative.

Ultimately, the work provides a practical method to convert natural-language CTI into a format that supports automated security reasoning, moving beyond simple entity extraction toward actionable attack-path analysis.