Source-linked AI summary
BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligence
Changze Li, Yutong Cheng, Tsania Camila Finnisa, Qian Cui, Wei Ding, Peng Gao
TL;DR
CTI knowledge-graph methods have largely handled partial information within individual reports, while cross-source alignment remains difficult when the same threat has unrelated names. BEACON anchors entities and IoCs to MITRE ATT&CK techniques, verifies extracted candidates, and hierarchically merges report graphs. On newly constructed benchmarks, it outperforms all baselines by at least 23% on extraction and 9% on consolidation.
Problem
Existing CTI knowledge-graph methods extract only partial report information and lack reliable cross-source alignment for threats with unrelated names.
Method
BEACON uses two stages: propose-then-verify extraction that attaches entities and IoCs to ATT&CK technique anchors, followed by hierarchical graph consolidation using progressively less deterministic alignment signals.
Results
BEACON outperforms all baselines by at least 23% on report-level extraction and 9% on cross-source consolidation.
Takeaways & Limitations
ATT&CK technique neighborhoods provide a critical domain-specific signal for aligning entities whose names are unrelated across CTI sources.
Takeaways & Limitations
The consolidation evaluation includes false merges between distinct actors that share techniques, such as Black Basta and Cactus.
Abstract
from arXiv · showhide
Cyber threat intelligence (CTI) is foundational to modern cyber defense, yet much of it resides in unstructured reports whose volume and heterogeneity far exceed manual analysis, motivating research on automatically constructing knowledge graphs from CTI reports. However, existing approaches mainly extract partial information within a single report, leaving the cross-source setting unexplored, where the same threat is given unrelated names. Our key insight is that attack behaviors, once mapped to MITRE ATT&CK (a standardized catalog of attack techniques), can anchor the rest of a report. Attack behaviors are the adversarial actions a report describes, while contextual entities (e.g., threat actors, campaigns, and affected products) and Indicators of Compromise (IoCs; e.g., IP addresses) are their participants and traces. Attaching them to these anchors places every per-report graph in one canonical space. We realize this insight in BEACON, an LLM-driven framework for cross-source CTI knowledge graph construction. Its first stage extracts each report into a graph under a propose-then-verify paradigm, grounding candidates in report evidence and official ATT&CK definitions, to suppress LLM misclassification and hallucination. Its second stage merges these graphs with a hierarchical alignment strategy that applies signals in decreasing order of determinism, from character-level and semantic similarity to overlapping technique neighborhoods, iterating as merges pool neighborhoods. No existing benchmark links entities to technique anchors or provides cross-source alignment ground truth. We therefore construct and release two human-annotated datasets from 34 sources: to our knowledge the largest for report-level CTI extraction (8,395 elements) and the first for cross-source consolidation (3,487). On them, BEACON outperforms all baselines by at least 23% and 9%, respectively.
1 Introduction
CTI reports are heterogeneous and existing methods capture only partial information, especially across sources where identical threats receive unrelated names. BEACON addresses this gap by anchoring report information to ATT&CK techniques and hierarchically consolidating the resulting graphs.
- Motivation: CTI reports combine contextual entities, ATT&CK-mapped attack behaviors, and low-level IoCs, but their volume and heterogeneity exceed manual analysis.Contextual entities include actors, campaigns, malware families, and products; IoCs include traces such as IP addresses and file hashes.
- Research gap: Existing approaches either map behaviors to ATT&CK while omitting contextual entities and IoCs, or extract entities and IoCs without linking them to techniques.
- Research gap: Cross-source alignment remains unreliable because vendors use different names for the same threat, while string, embedding, and exhaustive LLM comparisons face coverage, cost, or false-merge problems.Examples include Cl0p, Clop, and Graceful Spider for one actor, with unrelated names defeating embedding similarity.
- Approach: BEACON attaches contextual entities and IoCs to ATT&CK technique anchors, placing per-report graphs in a shared canonical space for alignment.The anchors provide a domain-specific signal for entities whose names are unrelated.
- Approach: BEACON extracts graphs through propose-then-verify grounding in report evidence and official ATT&CK definitions, then consolidates them using progressively less deterministic signals and LLM verification.
- Evaluation: 8,395 nodes and edges populate BEACON-Single, while BEACON-Group contains 100 reports from 31 publishers in 33 threat groups; BEACON beats baselines by at least 23% on extraction and 9% on consolidation.On differently spelled or unrelated names, the improvement is at least 27%; ablations identify ATT&CK technique neighborhoods as critical.
2 Related Work
Prior CTI and entity-matching systems provide separate pieces of extraction or rely mainly on textual similarity, leaving difficult cross-source naming divergences unresolved. BEACON combines ATT&CK-linked information with graph-based alignment to construct one cross-source graph covering all three CTI information types.
- CTI extraction: Research on CTI extraction separately maps behaviors to ATT&CK or extracts contextual relation triplets, rather than integrating both with their relationships.
- BEACON: BEACON constructs one graph across sources that covers contextual entities, attack behaviors, and IoCs.
- Entity matching: Classical and neural entity matching rely on names, attributes, or learned textual representations, which perform poorly when records lack overlap or use substantially different names.Graph structure can provide an additional matching signal beyond textual semantics.
- Cross-source alignment: Within CTI, existing alignment methods use single-report deduplication or embedding thresholds and fail on unrelated codewords, alphanumeric labels, and deceptively similar identifiers.Examples include Wicked Panda versus Brass Typhoon, APT41 versus TA415, and APT41 versus APT40.
3 Methodology
BEACON constructs report-level CTI graphs by anchoring contextual entities and IoCs to verified MITRE ATT&CK techniques, then consolidates those graphs across sources through hierarchical, LLM-verified alignment.
- Space-Anchoring Stage: BEACON represents each report as a graph containing technique anchors, contextual entities, IoCs, and their verified edges.Technique anchors map to ATT&CK techniques; contextual entities and IoCs attach to those anchors through report-supported relationships.
- Behavior Grounding: Atomic behaviors are decomposed from report narratives, located deterministically in evidence spans, and mapped to candidate ATT&CK techniques verified against official definitions.Candidate generation prioritizes recall, while existence checks and definition-based judging suppress hallucinated or mismatched techniques.
- Entity and IoC Extraction: Contextual entities and IoCs are extracted from overlapping report windows, grounded in report text, normalized, deduplicated, and individually verified against ontology types.Candidates absent from the report are removed, while type-specific IoC normalization supports direct merging of identical normalized forms.
- Anchored Attachment: BEACON proposes entity–technique edges from shared evidence sentences and additionally links verified report-central actors, campaigns, or malware families to every report anchor.This second pass addresses central entities that are named in the report but not repeated within each behavior description.
- Consolidation Stage: Consolidation applies alignment signals from most to least deterministic, while later merges operate on graphs already updated by earlier matches.Deterministic matching covers identical ATT&CK IDs, normalized IoCs, and exact names; ambiguous candidates undergo node-level and cluster-level LLM verification.
4 Evaluation
BEACON is evaluated on report-level extraction, cross-source consolidation, and component contributions using expert-annotated datasets, standardized metrics, and controlled comparisons. It achieves leading extraction and consolidation performance, while analyses attribute gains to anchoring, verification, and complementary alignment channels.
- Evaluation Setup: 150 reports from 15 publishers form BEACON-Single, while 100 reports from 31 publishers form 33 threat groups in BEACON-Group.Each instance is independently labeled by two experts, with disagreements adjudicated by a senior annotator.
- Evaluation Setup: All results use micro precision, recall, and F1; consolidation is scored in merge-link units to reward partial recovery and penalize overmerging.Consolidation receives gold report-level nodes, isolating alignment quality from extraction quality.
- RQ1: Anchoring-Stage Extraction: 78.7% overall F1 is BEACON’s best space-anchoring result, exceeding every baseline by at least 23% across all five output types.The comparison with the step-guided LLM uses the same model, indicating the advantage comes from BEACON’s pipeline rather than model choice.
- RQ1: Anchoring-Stage Extraction: 84.60 recall drives BEACON’s technique-anchor advantage through atomic-behavior decomposition and verification against ATT&CK definitions.Candidate generation prioritizes recall, while evidence verification accepts only techniques supported by the report and official definitions.
- RQ1: Anchoring-Stage Extraction: Anchoring entities and IoCs to techniques improves recall beyond relation-triplet extraction, while deterministic IoC normalization supports BEACON’s IoC F1.IoCs often appear in lists rather than relation-bearing sentences, making relation-triplet methods especially incomplete.
- RQ1: Anchoring-Stage Extraction: Edges are the hardest outputs because correct predictions require accurate endpoints and verified relations, especially when IoCs and behaviors occur in separate evidence spans.Fewer IoC–TTP candidates are proposed because list-based IoCs rarely share a sentence with behavioral evidence.
- RQ2: Cross-Source Consolidation: 93.96 and 98.31 F1 are BEACON’s consolidation scores for the two node types, exceeding every baseline by at least 9%.Technique anchors are excluded because shared technique IDs allow deterministic merging.
5 Conclusion
BEACON addresses partial CTI extraction and the unexplored cross-source setting by anchoring report information to MITRE ATT&CK techniques and consolidating the resulting graphs. Its propose-then-verify stages and hierarchical alignment strategy support reliable merging across sources, and it outperforms all baselines on two released human-annotated datasets.
- BEACON targets partial CTI extraction and the unexplored cross-source setting.
- BEACON’s space-anchoring stage attaches contextual entities and IoCs to MITRE ATT&CK technique anchors, placing per-report graphs in one canonical space.
- Its consolidation stage applies merging signals in decreasing order of determinism, using shared technique neighborhoods to align entities with unrelated names.
- Both stages use propose-then-verify procedures grounded in report evidence to suppress misclassification and hallucination.
- BEACON outperforms all baselines on two human-annotated datasets that the authors construct and release.
Ethical Considerations
BEACON is positioned for defensive threat analysis using publicly available CTI reports and public MITRE ATT&CK definitions. Its datasets contain no private telemetry or undisclosed victim data, and released materials preserve attribution and follow publishers’ access terms.
- BEACON organizes publicly available CTI reports and grounds behaviors in public MITRE ATT&CK definitions for defensive threat analysis.
- The system generates no attack procedures, exploit code, or operational instructions beyond what source reports disclose.
- The datasets contain no private telemetry or undisclosed victim data, retaining victim information only when publicly disclosed and schema-required.
- Released materials preserve source attribution and comply with original publishers’ access terms, with restricted text provided as metadata and derived annotations.