融合威胁情报知识图谱与图约束推理的网络威胁归因框架

刘昌城; 杨长恒; 马骏

doi:10.11959/j.issn.2096-109x.AQ26010

您当前的位置：

首页 >

文章列表页 >

融合威胁情报知识图谱与图约束推理的网络威胁归因框架

学术论文 | 更新时间：2026-07-15

- 融合威胁情报知识图谱与图约束推理的网络威胁归因框架
- Cyber threat attribution framework integrating threat intelligence knowledge graph and graph constrained reasoning
- 网络与信息安全学报 2026年12卷第3期页码：154-166
- 作者机构：
  
  解放军网络空间部队信息工程大学，河南郑州 450001
- 作者简介：
  
  刘昌城（2001- ），男，信息工程大学硕士生，主要研究方向为网络空间安全与人工智能。
  杨长恒（2001- ），男，信息工程大学硕士生，主要研究方向为网络安全与知识图谱。
  马骏（1981- ），男，博士，信息工程大学副教授，主要研究方向为态势感知与威胁发现。
- 基金信息：
  
  国家自然科学基金面上资助项目(62477020)
- DOI：10.11959/j.issn.2096-109x.AQ26010
  中图分类号： TP393.08
- 收稿：2026-01-13，
  
  修回：2026-05-29，
  
  纸质出版：2026-06-25
- 稿件说明：
移动端阅览
刘昌城, 杨长恒, 马骏. 融合威胁情报知识图谱与图约束推理的网络威胁归因框架[J]. 网络与信息安全学报, 2026, 12(3): 154-166.

Liu Changcheng, Yang Changheng, Ma Jun. Cyber threat attribution framework integrating threat intelligence knowledge graph and graph constrained reasoning[J]. Chinese Journal of Network and Information Security, 2026, 12(3): 154-166.
刘昌城, 杨长恒, 马骏. 融合威胁情报知识图谱与图约束推理的网络威胁归因框架[J]. 网络与信息安全学报, 2026, 12(3): 154-166. DOI： 10.11959/j.issn.2096-109x.AQ26010.

Liu Changcheng, Yang Changheng, Ma Jun. Cyber threat attribution framework integrating threat intelligence knowledge graph and graph constrained reasoning[J]. Chinese Journal of Network and Information Security, 2026, 12(3): 154-166. DOI： 10.11959/j.issn.2096-109x.AQ26010.

摘要

针对大语言模型在网络威胁归因中存在幻觉、传统图约束推理对碎片化威胁情报数据鲁棒性不足的问题，对可信网络攻击溯源方法进行了研究。提出融合威胁情报知识图谱与图约束推理（TIKGCR）框架，构建攻击模式导向的知识图谱前缀树（KG-Trie）索引，设计自适应软约束解码与多路径证据聚合机制。实验结果显示，该框架在CTI-Trace和TRAIL数据集上归因准确率分别达94.6%和92.8%，幻觉率仅为1.5%；50%图谱缺失率下准确率仍保持85.5%，推理时间缩短约

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=113008023&type=

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=113008033&type=

2.28600001

6.26533365

。该框架实现了结构可信与语义鲁棒的平衡，为高风险场景下的网络威胁归因提供了有效技术支撑。

Abstract

To address the issues of hallucinations in large language models for cyber threat attribution and the insufficient robustness of traditional graph-constrained reasoning against fragmented threat intelligence data

research on credible cyber attack traceability methods was conducted. The framework integrating threat intelligence knowledge graph and graph-constrained reasoning (TIKGCR) was proposed

which constructs an attack pattern-oriented knowledge graph Trie (KG-Trie) index and designs an adaptive soft-constrained decoding and multi-path evidence aggregation mechanism. Experimental results show that the framework achieves attribution accuracies of

94.6% and 92.8% on the CTI-Trace and TRAIL datasets respectively

with a hallucination rate of only 1.5%. It maintains an accuracy of 85.5% under a 50% knowledge graph missing rate and inference time cut by roughly

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=113008050&type=

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=113008049&type=

2.28600001

6.26533365

. This framework achieves a balance between structural credibility and semantic robustness

providing effective technical support for cyber threat attribution in high-risk scenarios.

关键词

Keywords

references

Rani N , Saha B , Shukla S K . A comprehensive survey of automated advanced persistent threat attribution: taxonomy, methods, challenges and open research problems [J ] . Journal of Information Security and Applications , 2025 , 92 : 104076 .

Chang Y P , Wang X , Wang J D , et al . A survey on evaluation of large language models [J ] . ACM Transactions on Intelligent Systems and Technology , 2024 , 15 ( 3 ): 1 - 45 .

Huang L , Yu W J , Ma W T , et al . A survey on hallucination in large language models: principles, taxonomy, challenges, and open questions [J ] . ACM Transactions on Information Systems , 2025 , 43 ( 2 ): 1 - 55 .

Pan S R , Luo L H , Wang Y F , et al . Unifying large language models and knowledge graphs: a roadmap [J ] . IEEE Transactions on Knowledge and Data Engineering , 2024 , 36 ( 7 ): 3580 - 3599 .

Wei J , Wang X Z , Schuurmans D , et al . Chain-of-thought prompting elicits reasoning in large language models [C ] // Proceedings of the 36th International Conference on Neural Information Processing Systems . New York : ACM Press , 2022 : 24824 - 24837 .

Wang X , Wei J , Schuurmans D , et al . Self-consistency improves chain of thought reasoning in language models [C ] // Proceedings of International Conference on Learning Representations(ICLR) . 2023 .

Cao Y , Griffiths T , Narasimhan K , et al . Tree of thoughts: deliberate problem solving with large language models [C ] // Proceedings of the Advances in Neural Information Processing Systems 36 . Neural Information Processing Systems Foundation, Inc. (NeurIPS) , 2023 : 11809 - 11822 .

Phan D , Hoffman M D , Dohan D , et al . Training chain-of-thought via latent-variable inference [C ] // Proceedings of the 37th International Conference on Neural Information Processing Systems . New York : ACM Press , 2023 : 72819 - 72841 .

Huang J , Chen X , Mishra S , et al . Large language models cannot self-correct reasoning yet [C ] // Proceedings of International Conference on Learning Representations(ICLR) . 2024 .

夏毅 , 兰明敬 , 陈晓慧 , 等 . 可解释的知识图谱推理方法综述 [J ] . 网络与信息安全学报 , 2022 , 8 ( 5 ): 1 - 25 .

Xia Y , Lan M J , Chen X H , et al . Survey on explainable knowledge graph reasoning methods [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 5 ): 1 - 25 .

Chen Y , Sun S , Hu X C . DRKG: faithful and interpretable multi-hop knowledge graph question answering via LLM-guided reasoning plans [J ] . Applied Sciences , 2025 , 15 ( 12 ): 6722 .

Mavromatis C , Karypis G . GNN-RAG: graph neural retrieval for large language model reasoning [PP ] . arXiv Preprint , 2024 :arXiv. 2405.20139.

Jiang J H , Zhou K , Zhao W X , et al . KG-agent: an efficient autonomous agent framework for complex reasoning over knowledge graph [C ] // Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Kerrville : Association for Computational Linguistics , 2025 : 9505 - 9523 .

Sun J S , Xu C J , Tang L , et al . Think-on-graph: deep and responsible reasoning of large language model on knowledge graph [PP ] . arXiv Preprint , 2024 : arXiv. 2307 . 07697 .

Luo L , Zhao Z , Haffari G , et al . Graph-constrained reasoning: faithful reasoning on knowledge graphs with large language models [C ] // Proceeding of the 42nd International Conference on Machine Learning(ICLR) . 2025 : 41540 - 41565 .

黄克振 , 连一峰 , 冯登国 , 等 . 一种基于图模型的网络攻击溯源方法 [J ] . 软件学报 , 2022 , 33 ( 2 ): 683 - 698 .

Huang K Z , Lian Y F , Feng D G , et al . Method of cyber attack attribution based on graph model [J ] . Journal of Software , 2022 , 33 ( 2 ): 683 - 698 .

Xu Y J , Fang Y , Huang C , et al . HGHAN: hacker group identification based on heterogeneous graph attention network [J ] . Information Sciences , 2022 , 612 : 848 - 863 .

Zang X D , Gong J , Zhang X C , et al . Attack scenario reconstruction via fusing heterogeneous threat intelligence [J ] . Computers Security , 2023 , 133 : 103420 .

Zhang J , Zhang X K , Yu J F , et al . Subgraph retrieval enhanced model for multi-hop knowledge base question answering [C ] // Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Kerrville : Association for Computational Linguistics , 2022 : 5773 - 5784 .

沈晓晨 , 葛寅辉 , 陈波 , 等 . 人工智能安全知识图谱构建技术研究 [J ] . 网络与信息安全学报 , 2023 , 9 ( 2 ): 164 - 174 .

Shen X C , Ge Y H , Chen B , et al . Research on construction technology of artificial intelligence security knowledge graph [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 2 ): 164 - 174 .

Zhang G , Ali Alomrani M , Gu H J , et al . Extracting and following paths for robust relational reasoning with large language models [PP ] . arXiv Preprint , 2026 : arXiv. 2412.17963.

King I J , Ramirez R , Bowman B , et al . Trail: a knowledge graph-based approach for attributing advanced persistent threats [C ] // Proceedings of the 2025 IEEE 41st International Conference on Data Engineering (ICDE) . Piscataway : IEEE Press , 2025 : 1207 - 1220 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于知识图谱和污点传播的网络攻击检测方法

基于知识图谱的网络安全事件数据推荐算法

人工智能安全知识图谱构建技术研究

可解释的知识图谱推理方法综述

基于网络防御知识图谱的0day攻击路径预测方法