A Queryable Knowledge Graph of MITRE ATLAS: Cross-Linking Adversarial AI Taxonomies for Grounded Threat Reasoning
This paper presents a Neo4j-based knowledge graph that transforms the static MITRE ATLAS documentation into a queryable, LLM-grounded system cross-linked with the OWASP Top 10 for LLM Applications, enabling practitioners to perform threat reasoning, identify 40 unmitigated generative-AI techniques, and demonstrate the orthogonal nature of ATLAS tactics and OWASP risk categories.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you have a massive, incredibly detailed encyclopedia written by security experts called MITRE ATLAS. This book describes every known way a "digital villain" can hack an Artificial Intelligence system. It lists the villains' goals (tactics), their specific tricks (techniques), the defenses available (mitigations), and real stories of attacks that have already happened (case studies).
The problem, according to this paper, is that this encyclopedia is static. It's like a library where the books are locked behind glass. You can read them, but you can't ask the librarian, "Show me every trick that has no defense yet," or "Connect the dots between this specific attack and that specific weakness." You have to manually flip through pages, cross-reference lists, and hope you don't miss anything.
Salwa Makni's paper is about turning that locked library into a living, interactive map.
Here is the breakdown of what they did, using simple analogies:
1. Building the Map (The Knowledge Graph)
Instead of keeping the data in a list or a document, the author built a digital spiderweb (called a "Knowledge Graph" in Neo4j).
- The Nodes (The Dots): Each dot represents a piece of the puzzle: a specific attack trick, a villain's goal, a defense strategy, or a real-world attack story.
- The Strings (The Connections): The lines connecting the dots show how they relate. For example, a line connects "LLM Prompt Injection" (a trick) to "Prompt Injection" (the goal) and another line connects it to "Input Validation" (the defense).
- Why this matters: In a normal document, finding a connection requires reading. In this map, you can instantly "walk" from a trick to its defense, or see which tricks have no strings attached to any defense at all.
2. Merging Two Different Languages (Cross-Linking)
Security teams speak two different languages:
- MITRE ATLAS speaks in "Adversary Tactics" (How the bad guys think and move).
- OWASP Top 10 speaks in "App Vulnerabilities" (Where the software is weak).
The author manually drew bridges between these two worlds. They took the 10 major categories of LLM risks from OWASP and connected them to the specific tricks in MITRE ATLAS.
- The Discovery: They found that these two lists aren't just repeating each other; they are orthogonal (like the X and Y axes on a graph). One organizes by what the bad guy wants to do, and the other by where the software is weak. By connecting them, you get a 3D view of the problem rather than a flat 2D list.
3. The "Grounded" Detective (The Reasoning Engine)
The author built a tool that uses an AI (LLM) to answer questions, but with a strict rule: The AI is not allowed to make things up.
- How it works: When you ask, "How do I stop this attack?", the AI doesn't just guess based on its training. Instead, it acts like a librarian who first looks up the specific ID number of the attack in the map, grabs the exact facts from the database, and then summarizes them for you.
- The Benefit: If the map says "No defense exists," the AI says "No defense exists." It doesn't hallucinate a fake solution. Every answer comes with a "citation tag" pointing back to the original source, like a footnote in a research paper.
4. What They Found (The Results)
By running queries on this map, the author uncovered some hard truths that were hidden in the static documents:
- The Defense Gap: They found 40 specific tricks targeting Generative AI that currently have zero documented defenses. It's like finding 40 new ways to pick a lock where no lockpick exists yet.
- The Best Defenses: They identified which defenses cover the most ground. For example, "AI Telemetry Logging" (keeping a detailed log of what the AI does) covers 17 different attack tricks, making it a high-priority defense.
- The Orthogonality: They proved that you can't just use one list (OWASP) to solve the other (ATLAS). You need both to see the full picture.
5. What It Is (and What It Isn't)
- It is: A working prototype, a database, and a set of tools that let security engineers ask complex questions and get answers based on hard data, not guesses.
- It is not: A finished commercial product (yet). The author admits the map is still being built. Some connections (like why a defense works) aren't fully detailed yet, and the "AI Detective" can sometimes miss a trick if the initial question isn't perfect.
- It is not: A magic wand that fixes AI security. It's a tool to help humans understand the landscape better so they can build better defenses.
In short: The paper turns a static, hard-to-read list of AI threats into a dynamic, searchable map. It connects two different security languages, uses AI to answer questions without lying, and highlights exactly where our defenses are missing in the fight against AI hackers.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.