Cyber threat attribution framework integrating threat intelligence knowledge graph and graph constrained reasoning

Liu Changcheng; Yang Changheng; Ma Jun

doi:10.11959/j.issn.2096-109x.AQ26010

您当前的位置：

首页 >

文章列表页 >

Cyber threat attribution framework integrating threat intelligence knowledge graph and graph constrained reasoning

Papers | 更新时间：2026-07-15

- Cyber threat attribution framework integrating threat intelligence knowledge graph and graph constrained reasoning
- Chinese Journal of Network and Information Security Vol. 12, Issue 3, Pages: 154-166(2026)
- 作者机构：
  
  解放军网络空间部队信息工程大学，河南郑州 450001
- 作者简介：
- 基金信息：
  
  The General Project of National Natural Science Foundation of China(62477020)
- DOI：10.11959/j.issn.2096-109x.AQ26010
  CLC： TP393.08
- Received：13 January 2026，
  
  Revised：2026-05-29，
  
  Published：25 June 2026
- 稿件说明：
移动端阅览
刘昌城, 杨长恒, 马骏. 融合威胁情报知识图谱与图约束推理的网络威胁归因框架[J]. 网络与信息安全学报, 2026, 12(3): 154-166.

Liu Changcheng, Yang Changheng, Ma Jun. Cyber threat attribution framework integrating threat intelligence knowledge graph and graph constrained reasoning[J]. Chinese Journal of Network and Information Security, 2026, 12(3): 154-166.
刘昌城, 杨长恒, 马骏. 融合威胁情报知识图谱与图约束推理的网络威胁归因框架[J]. 网络与信息安全学报, 2026, 12(3): 154-166. DOI： 10.11959/j.issn.2096-109x.AQ26010.

Liu Changcheng, Yang Changheng, Ma Jun. Cyber threat attribution framework integrating threat intelligence knowledge graph and graph constrained reasoning[J]. Chinese Journal of Network and Information Security, 2026, 12(3): 154-166. DOI： 10.11959/j.issn.2096-109x.AQ26010.

摘要

针对大语言模型在网络威胁归因中存在幻觉、传统图约束推理对碎片化威胁情报数据鲁棒性不足的问题，对可信网络攻击溯源方法进行了研究。提出融合威胁情报知识图谱与图约束推理（TIKGCR）框架，构建攻击模式导向的知识图谱前缀树（KG-Trie）索引，设计自适应软约束解码与多路径证据聚合机制。实验结果显示，该框架在CTI-Trace和TRAIL数据集上归因准确率分别达94.6%和92.8%，幻觉率仅为1.5%；50%图谱缺失率下准确率仍保持85.5%，推理时间缩短约

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=113008023&type=

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=113008033&type=

2.28600001

6.26533365

。该框架实现了结构可信与语义鲁棒的平衡，为高风险场景下的网络威胁归因提供了有效技术支撑。

Abstract

To address the issues of hallucinations in large language models for cyber threat attribution and the insufficient robustness of traditional graph-constrained reasoning against fragmented threat intelligence data

research on credible cyber attack traceability methods was conducted. The framework integrating threat intelligence knowledge graph and graph-constrained reasoning (TIKGCR) was proposed

which constructs an attack pattern-oriented knowledge graph Trie (KG-Trie) index and designs an adaptive soft-constrained decoding and multi-path evidence aggregation mechanism. Experimental results show that the framework achieves attribution accuracies of

94.6% and 92.8% on the CTI-Trace and TRAIL datasets respectively

with a hallucination rate of only 1.5%. It maintains an accuracy of 85.5% under a 50% knowledge graph missing rate and inference time cut by roughly

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=113008050&type=

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=113008049&type=

2.28600001

6.26533365

. This framework achieves a balance between structural credibility and semantic robustness

providing effective technical support for cyber threat attribution in high-risk scenarios.

关键词

Keywords

references

Rani N , Saha B , Shukla S K . A comprehensive survey of automated advanced persistent threat attribution: taxonomy, methods, challenges and open research problems [J ] . Journal of Information Security and Applications , 2025 , 92 : 104076 .

Chang Y P , Wang X , Wang J D , et al . A survey on evaluation of large language models [J ] . ACM Transactions on Intelligent Systems and Technology , 2024 , 15 ( 3 ): 1 - 45 .

Huang L , Yu W J , Ma W T , et al . A survey on hallucination in large language models: principles, taxonomy, challenges, and open questions [J ] . ACM Transactions on Information Systems , 2025 , 43 ( 2 ): 1 - 55 .

Pan S R , Luo L H , Wang Y F , et al . Unifying large language models and knowledge graphs: a roadmap [J ] . IEEE Transactions on Knowledge and Data Engineering , 2024 , 36 ( 7 ): 3580 - 3599 .

Wei J , Wang X Z , Schuurmans D , et al . Chain-of-thought prompting elicits reasoning in large language models [C ] // Proceedings of the 36th International Conference on Neural Information Processing Systems . New York : ACM Press , 2022 : 24824 - 24837 .

Wang X , Wei J , Schuurmans D , et al . Self-consistency improves chain of thought reasoning in language models [C ] // Proceedings of International Conference on Learning Representations(ICLR) . 2023 .

Cao Y , Griffiths T , Narasimhan K , et al . Tree of thoughts: deliberate problem solving with large language models [C ] // Proceedings of the Advances in Neural Information Processing Systems 36 . Neural Information Processing Systems Foundation, Inc. (NeurIPS) , 2023 : 11809 - 11822 .

Phan D , Hoffman M D , Dohan D , et al . Training chain-of-thought via latent-variable inference [C ] // Proceedings of the 37th International Conference on Neural Information Processing Systems . New York : ACM Press , 2023 : 72819 - 72841 .

Huang J , Chen X , Mishra S , et al . Large language models cannot self-correct reasoning yet [C ] // Proceedings of International Conference on Learning Representations(ICLR) . 2024 .

夏毅 , 兰明敬 , 陈晓慧 , 等 . 可解释的知识图谱推理方法综述 [J ] . 网络与信息安全学报 , 2022 , 8 ( 5 ): 1 - 25 .

Xia Y , Lan M J , Chen X H , et al . Survey on explainable knowledge graph reasoning methods [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 5 ): 1 - 25 .

Chen Y , Sun S , Hu X C . DRKG: faithful and interpretable multi-hop knowledge graph question answering via LLM-guided reasoning plans [J ] . Applied Sciences , 2025 , 15 ( 12 ): 6722 .

Mavromatis C , Karypis G . GNN-RAG: graph neural retrieval for large language model reasoning [PP ] . arXiv Preprint , 2024 :arXiv. 2405.20139.

Jiang J H , Zhou K , Zhao W X , et al . KG-agent: an efficient autonomous agent framework for complex reasoning over knowledge graph [C ] // Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Kerrville : Association for Computational Linguistics , 2025 : 9505 - 9523 .

Sun J S , Xu C J , Tang L , et al . Think-on-graph: deep and responsible reasoning of large language model on knowledge graph [PP ] . arXiv Preprint , 2024 : arXiv. 2307 . 07697 .

Luo L , Zhao Z , Haffari G , et al . Graph-constrained reasoning: faithful reasoning on knowledge graphs with large language models [C ] // Proceeding of the 42nd International Conference on Machine Learning(ICLR) . 2025 : 41540 - 41565 .

黄克振 , 连一峰 , 冯登国 , 等 . 一种基于图模型的网络攻击溯源方法 [J ] . 软件学报 , 2022 , 33 ( 2 ): 683 - 698 .

Huang K Z , Lian Y F , Feng D G , et al . Method of cyber attack attribution based on graph model [J ] . Journal of Software , 2022 , 33 ( 2 ): 683 - 698 .

Xu Y J , Fang Y , Huang C , et al . HGHAN: hacker group identification based on heterogeneous graph attention network [J ] . Information Sciences , 2022 , 612 : 848 - 863 .

Zang X D , Gong J , Zhang X C , et al . Attack scenario reconstruction via fusing heterogeneous threat intelligence [J ] . Computers Security , 2023 , 133 : 103420 .

Zhang J , Zhang X K , Yu J F , et al . Subgraph retrieval enhanced model for multi-hop knowledge base question answering [C ] // Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Kerrville : Association for Computational Linguistics , 2022 : 5773 - 5784 .

沈晓晨 , 葛寅辉 , 陈波 , 等 . 人工智能安全知识图谱构建技术研究 [J ] . 网络与信息安全学报 , 2023 , 9 ( 2 ): 164 - 174 .

Shen X C , Ge Y H , Chen B , et al . Research on construction technology of artificial intelligence security knowledge graph [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 2 ): 164 - 174 .

Zhang G , Ali Alomrani M , Gu H J , et al . Extracting and following paths for robust relational reasoning with large language models [PP ] . arXiv Preprint , 2026 : arXiv. 2412.17963.

King I J , Ramirez R , Bowman B , et al . Trail: a knowledge graph-based approach for attributing advanced persistent threats [C ] // Proceedings of the 2025 IEEE 41st International Conference on Data Engineering (ICDE) . Piscataway : IEEE Press , 2025 : 1207 - 1220 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Network attack detection method based on knowledge graph and taint propagation

Data recommendation algorithm of network security event based on knowledge graph

Research on construction technology of artificial intelligence security knowledge graph

Survey on explainable knowledge graph reasoning methods

Prediction method of 0day attack path based on cyber defense knowledge graph

Related Author

ZHANG Liang

ZHOU Zhimo

ZOU Futai

HUANG Mingyi

Zeyu GU

Zihao LIU

Wei LIU

Xianwei ZHU

Related Institution

School of Cyber Science and Engineering, Shanghai Jiao Tong University

East Branch of State Grid Corporation of China

School of Computer and Electronic Information/School of Artificial Intelligence, Nanjing Normal University

School of Mathematical Science, Nanjing Normal University

⁰