PaperlayerView exact revision on arXiv

Source-linked AI summary

NeuroGraph: An AI Graph-Driven Neuro-Symbolic Framework for Explainable Threat Reasoning in Advanced Manufacturing

Padmeswari Nandiya, Ahmad Mohsin, Ahmed Ibrahim, Iqbal H. Sarker, Helge Janicke

arXiv:2609.00604v1cs.CRcs.IR

TL;DR

The paper addresses the difficulty of explaining and structuring CTI reasoning across interconnected cyber-physical IT and OT environments, where text-based and many Graph-RAG methods provide limited ontology-consistent multi-hop support. It proposes GRICS, which combines ontology-constrained Cypher retrieval, controlled embedding fallback, and LLM answer synthesis over a BRIDG-ICS knowledge graph. Across CTI-RCM and CTI-ATE, the graph-enhanced setup outperformed baseline LLMs, while producing traceable evidence chains and preserving coherent reasoning under adversarial and structurally complex queries.

  • Problem

    CTI analysis in interconnected IT–OT environments lacks reliable, ontology-consistent, and transparent multi-hop reasoning over heterogeneous cyber-physical threats.

  • Method

    GRICS uses a dual-LLM neuro-symbolic pipeline in which ontology-aware Cypher retrieval supplies graph evidence for grounded answer generation, with embedding fallback limited to graph-anchor recovery.

  • Results

    On CTI-RCM and CTI-ATE benchmarks, GRICS consistently outperformed baseline LLMs, with the fine-tuned, graph-enhanced setup performing best.

  • Takeaways & Limitations

    GRICS provides traceable evidence chains and more coherent multi-hop reasoning under adversarial and structurally complex queries.

  • Takeaways & Limitations

    The study does not evaluate explanation usefulness, trust, evidence verification, or decision-making efficiency with cybersecurity practitioners.

Abstract

from arXiv · show

The growing complexity of cyber-physical attack surfaces in advanced manufacturing has made cyber threat intelligence analysis increasingly difficult. Although large language models and retrieval-augmented generation have improved CTI workflows, text-based approaches remain vulnerable to hallucinations and provide limited support for structured reasoning over interconnected threats. Graph-based RAG reduces some of these limitations, but existing approaches often lack ontology-consistent multi-hop reasoning and transparent evidence tracing across heterogeneous cybersecurity data. This paper proposes a graph-grounded neuro-symbolic framework that integrates ontology-aware symbolic query generation, knowledge graph retrieval, and neural language generation to support accurate and explainable threat analysis across information technology and operational technology environments. The framework adopts a dual-large language model architecture: the first model translates natural-language questions into executable Cypher queries for symbolic graph retrieval, while the second generates answers strictly from the retrieved graph evidence. Experimental evaluation using publicly available cyber threat intelligence benchmarks shows consistent improvements over the published baseline in reasoning accuracy, while also reducing hallucinations, strengthening multi-hop reasoning, and improving robustness to adversarial perturbations. Runtime and explainability analyses further demonstrate that the framework maintains interactive inference performance and exposes graph-grounded reasoning artifacts that allow analysts to inspect and verify each stage of the analysis. Overall, the results highlight the potential of graph-grounded neuro-symbolic reasoning as a scalable, interpretable, and reliable approach to cyber threat intelligence for next-generation Industry 5.0 environments.

1 Introduction

The paper presents GRICS, a graph-grounded neuro-symbolic framework for explainable cyber-physical threat reasoning in interconnected IT and OT environments. Its symbolic-first architecture uses ontology-constrained Cypher retrieval, controlled fallback, and graph-grounded response generation to support transparent multi-hop analysis.

  • Motivation: Interconnected ICS and cyber-physical systems have expanded attack surfaces and enabled attacks with tangible physical consequences.The paper motivates intelligent mechanisms for analyzing and mitigating complex multi-stage cyber-physical attack scenarios.
  • Research gap: Text-based RAG remains vulnerable to hallucinations and limited structured reasoning across IT, OT, and physical processes.The challenge concerns interconnected attack paths rather than isolated document retrieval.
  • Framework: GRICS combines a cyber-physical knowledge graph with dual LLMs: one generates ontology-aware Cypher queries, while the other answers from retrieved graph evidence.Separating retrieval from generation supports multi-hop inference and reduces unsupported model generation.
  • Framework: Symbolic Cypher execution is the primary retrieval pathway, while embedding retrieval is restricted to recovering graph anchors after symbolic-query failure.Recovered anchors must be converted into ontology-compliant executable queries before evidence reaches answer generation.
  • Explainability and scope: The framework exposes generated queries, retrieved evidence, and grounded responses so analysts can inspect and verify each reasoning stage.The framework assumes a curated BRIDG-ICS-based knowledge graph and does not address ontology evolution or continuous graph synchronization.

2 Preliminaries

The preliminaries frame cyber-physical threats as interconnected, multi-stage relationships across IT, OT, assets, vulnerabilities, attack patterns, and physical processes. Graph-based RAG supplies structured subgraphs for multi-hop reasoning and explainable analysis.

  • Cyber-physical environments: Industry 5.0 ICS environments require analysis across interconnected intelligent systems, industrial assets, vulnerabilities, and attacker behaviours.Knowledge graphs provide a unified, machine-interpretable representation across IT and OT domains.
  • Retrieval foundations: RAG grounds LLM outputs in external knowledge, while Graph-RAG retrieves structured subgraphs R⊆G to support multi-hop reasoning.Graph-based retrieval addresses the limited relational structure of unstructured text.
  • Symbolic–semantic reasoning: Symbolic–semantic reasoning maps a natural-language input q∈X* to a structured representation c∈C whose execution on graph G yields results R=exec(c,G).This combines semantic interpretation with symbolic graph operations for traceable threat analysis.
  • Threat modelling: Cyber-physical threat modelling represents incidents as dependent events linking software vulnerabilities, weaknesses, attack patterns, adversarial techniques, and operational assets.Explicit dependencies support analysis of multi-stage attack paths across interconnected systems.
  • Threat modelling: These structured representations support correlation of heterogeneous cybersecurity information and explainable security decision-making across IT and OT infrastructures.The rationale is especially relevant where intelligent systems, industrial assets, and human operators are tightly interdependent.

3 Related Work

Related work shows that Graph-RAG improves structured retrieval but often leaves reasoning implicit, approximate, or insufficiently constrained for complex cyber-physical dependencies. GRICS distinguishes itself by requiring ontology-compliant Cypher execution before graph evidence is accepted.

  • RAG and Graph-RAG: RAG improves grounding but unstructured text provides limited support for representing relationships and performing multi-step cybersecurity inference.Graph representations explicitly encode entities and relations to enrich contextual grounding.
  • Retrieval strategies: Embedding-based retrieval is efficient and scalable but may return semantically relevant yet causally invalid connections because it lacks explicit structural constraints.This can produce structurally inconsistent multi-hop inference.
  • Retrieval strategies: Existing Graph-RAG and related methods include hierarchical, structured, agentic, and neural graph-reasoning approaches with different trade-offs in scalability, flexibility, and interpretability.The literature includes tree-based retrieval, clustering and summarisation, iterative tool use, and learned graph representations.
  • Cybersecurity applications: Existing cybersecurity approaches improve structured retrieval but remain limited in representing complex, multi-stage cyber-physical dependencies and explicit intermediate verification.The related work identifies a gap in deterministic graph traversal and transparent reasoning steps.
  • GRICS distinction: GRICS accepts evidence only after ontology-compliant Cypher execution over the BRIDG-ICS ontology, unlike approaches that independently combine retrieval strategies or rely on iterative agentic tool invocation.Embedding retrieval can recover anchors, but cannot independently determine final reasoning evidence.
  • Ontological modelling: Cybersecurity knowledge graphs build on standards such as MITRE ATT&CK, CAPEC, STIX, CVE, and CWE to represent threat intelligence, vulnerabilities, and attack behaviours.These foundations support machine-interpretable knowledge sharing and analysis.

4 Problem Statement

The problem is to support CTI reasoning across heterogeneous, interconnected IT–OT entities and multiple abstraction levels. The framework assumes trusted ontology-based graph evidence and limits its scope to BRIDG-ICS graph-grounded reasoning rather than graph construction or evolution.

  • Problem formulation: Industry 5.0 CTI requires reasoning across heterogeneous entities and multiple abstraction levels instead of isolated document retrieval or keyword matching.The relevant environment spans IT, OT, industrial assets, vulnerabilities, and attacker behaviours.
  • Problem formulation: Conventional RAG lacks explicit entity relationships, while many Graph-RAG methods rely on embedding similarity, heuristic expansion, or summarisation rather than deterministic ontology-compliant traversal.The problem includes limited transparent multi-hop reasoning for complex cyber-physical environments.
  • Assumptions: The framework assumes a trusted ontology-based knowledge graph that accurately represents cyber-physical entities and relationships.Retrieved graph information is treated as authoritative, while the language model interprets and summarizes it rather than generating unsupported knowledge.
  • Scope and limitations: The study is limited to graph-grounded cyber threat reasoning over the BRIDG-ICS ontology and does not address automatic ontology construction, graph population, or ontology evolution.Formal evaluation of analyst trust and cognitive workload is also outside the study’s scope.

5 Proposed GRICS Framework

GRICS is a cyber-physical KG-RAG framework for interpretable multi-hop threat reasoning in Industry 5.0 environments. It combines ontology-constrained symbolic retrieval with neural generation and uses embedding retrieval only to recover graph anchors when symbolic execution fails.

  • Framework architecture: The framework targets multi-hop attack-path analysis, threat-impact assessment, and mitigation-strategy generation through domain-specific KG-RAG.Its focus is advanced threat reasoning in Industry 5.0 cyber-physical environments.
  • Knowledge graph construction: BRIDG-ICS integrates industrial assets, software, vulnerabilities, weaknesses, attack patterns, MITRE ATT&CK techniques, and operational zones using typed relationships.The ontology provides the semantic structure for aligning heterogeneous cybersecurity sources and supports explainable reasoning across IT and OT environments.
  • Knowledge graph construction: The knowledge-graph pipeline extracts source records, normalizes entities, maps relationships, and ingests the resulting node and relationship tables.Canonical identifiers align heterogeneous CVE, CWE, CAPEC, MITRE ATT&CK, and CPE records while reducing duplication.
  • Knowledge graph construction: Industry 5.0 assets connect through CVE, CWE, CAPEC, and MITRE ATT&CK entities, enabling multi-hop attack-path analysis and threat attribution.Operational communication edges also carry risk-related attributes for quantitative vulnerability-propagation assessment.
  • Symbolic retrieval and fallback: Ontology-constrained Cypher execution is the primary retrieval pathway, while embedding retrieval only recovers graph anchors for regenerating valid symbolic queries after failure.All downstream reasoning remains grounded in explicit knowledge-graph traversal.
  • Human–AI interaction: The resulting interactive system lets users submit natural-language questions about vulnerabilities, attack paths, and system risks and receive knowledge-graph-grounded responses.The pipeline combines symbolic graph reasoning with embedding-supported recovery.

6 Evaluation

The evaluation compares GRICS configurations across benchmark performance, retrieval behavior, robustness-oriented analyses, and explainability-related evidence. Full GRICS combines ontology-grounded symbolic retrieval, Cypher fine-tuning, and embedding-assisted recovery, achieving the strongest reported benchmark results while improving traceability.

  • Evaluation design: The evaluation uses identical benchmark inputs and inference settings to compare Base KG-RAG, KG-RAG+FT, KG-RAG+EF, and Full GRICS across CTI tasks.The protocol examines retrieval accuracy, multi-hop reasoning, robustness, computational performance, ontology consistency, and reasoning traceability.
  • Evaluation design: The QA dataset contains 450 ontology-aligned samples derived from 65 CVEs with complete CVE→CWE→CAPEC→ATT&CK mappings.Queries cover diverse threat-centric reasoning tasks and use paraphrasing and identifier variation to encourage structural generalisation.
  • Model training and fine-tuning: Fine-tuning adapts the Cypher-LLM to generate executable, ontology-consistent queries, with a final training loss of 0.0052.The method uses parameter-efficient fine-tuning and few-shot prompting to constrain valid labels, relationships, and properties.
  • Benchmark performance: Full GRICS achieves 87.60% accuracy and 0.930 F1 on CTI-RCM 2024, 90.40% and 0.949 on CTI-RCM 2021, and 77.15% and 0.871 on CTI-ATE.It obtains the highest performance across all three evaluated datasets, with lower CTI-ATE performance associated with greater relational complexity.
  • Explainability and retrieval behavior: Cypher fine-tuning improves direct symbolic resolution and semantic coverage, while embedding-assisted recovery reduces unresolved queries without replacing symbolic execution.Recovered semantic anchors are converted into ontology-compliant Cypher queries, preserving graph-grounded reasoning and evidence traceability.

6.3 Robustness Against Adversarial Attacks

GRICS is evaluated against adversarial and noisy analyst inputs using attack, token, accuracy, and recovery measures. Results show greater difficulty under semantic perturbations, strong embedding-assisted recovery for corrupted inputs, and important limits on cross-study comparison and longer reasoning paths.

  • Adversarial attacks: TPQ measures the average adversarial content injected per query, with larger values indicating that more injected tokens are required to influence retrieval.The metric complements ASR by characterizing attack effort rather than only attack success.
  • Adversarial attacks: 120 multi-hop queries were evaluated under lexical and semantic perturbations, restricted to ATT&CK-oriented malware, technique, and mitigation reasoning tasks.The restricted scope was selected for comparability with PoisonRAG and GRAPPOISON.
  • Adversarial attacks: 71.6% aggregate ASR was observed across adversarial attacks, with semantic perturbations reaching 74.9% versus 68.3% for lexical perturbations.The higher semantic-attack rate indicates that context-level manipulation challenged the reasoning pipeline more than surface-level changes.
  • Comparison and scope: Robustness values in comparison with PoisonRAG and GRAPPOISON provide qualitative context rather than controlled evidence of quantitative superiority.The systems used different knowledge graphs, construction procedures, attack implementations, and evaluation protocols.
  • Noisy analyst inputs: 82.7% accuracy for KG-RAG+EF and 83.8% for Full GRICS show strong robustness to combined typographical and grammatical noise, primarily through semantic graph-anchor recovery.Embedding-assisted recovery identifies a related graph entity before regenerating an ontology-compliant Cypher query and resuming symbolic retrieval.
  • Noisy analyst inputs: 100% of evaluated one- to three-hop queries were resolved by KG-RAG+EF and Full GRICS under recoverable entity-format noise, versus 0% for Base KG-RAG and KG-RAG+FT.Beyond three hops, increased relational complexity may produce incomplete or hallucinated query structures.

6.4 Runtime Performance Analysis

GRICS maintains interactive inference performance while improving structural reliability, ontology alignment, and multi-hop reasoning completeness. Runtime remains dominated by LLM stages, while graph retrieval and fallback add comparatively little overhead.

  • Runtime Performance: 0.86–2.58 seconds: Cypher generation requires this range, while response synthesis averages approximately 1.46 seconds.Symbolic retrieval contributes comparatively little overhead for most query types.
  • Memory Utilisation: Approximately 6.3 GB of GPU memory is required by the 4-bit Llama-3.1-8B model, compared with 1.9 GB for the graph and 45 MB for embeddings in host memory.Embedding storage grows approximately linearly with the number of embedded entities.
  • Reasoning Stability: As hop depth increases, hallucination and query-violation rates rise while schema consistency declines for both models.Structural degradation becomes increasingly evident beyond three hops, although fine-tuning consistently outperforms the baseline.
  • Reasoning Completeness: 62%: the fine-tuned model recovers complete paths of four or more hops, compared with 22% for the baseline.The divergence is most pronounced at four- and five-hop depths.
  • Error Characteristics: Fine-tuning produces fewer compound errors and more structurally interpretable outputs, while enabling more direct symbolic traversal and fewer unresolved cases.Baseline failures commonly combine incorrect relationship targets with fabricated or mismatched node identifiers.

6.6 Use Cases

GRICS applies graph-grounded multi-hop reasoning to attack paths, vulnerabilities, adversarial techniques, and mitigation planning across heterogeneous cybersecurity data. The use cases emphasize structured traversal, authoritative-source consistency, and cross-layer countermeasures.

  • Use-Case Scope: GRICS integrates MITRE ATT&CK, NVD, CAPEC, and industrial asset information for four core analytical capabilities.These capabilities include attack-path analysis, vulnerability assessment, adversarial attribution, and mitigation planning.
  • Vulnerability Analysis: Vulnerability analysis aligns retrieved information with official CVE records and derives mitigation guidance including patching, input validation, and secure configuration.The workflow combines vulnerability-specific evidence with traceable mitigation recommendations.
  • Adversarial Attribution: Structured graph traversal identifies malware entities and associated MITRE ATT&CK techniques, whose operational intent and defensive considerations are synthesized into explanations.The TinyZBot analysis is validated against its official MITRE ATT&CK software entry.
  • Mitigation Derivation: GRICS derives mitigation strategies through multi-hop traversal across CVE, CWE, CAPEC, ATT&CK, and mitigation entities.The examples retrieve countermeasures at both ATT&CK and CWE abstraction levels.
  • Overall Capability: The use cases demonstrate unified integration of attack-path analysis, vulnerability assessment, adversarial attribution, and mitigation planning.The framework supports interpretable multi-hop inference and structured knowledge synthesis for Industry 5.0 ecosystems.

End-to-End Explainability Example

The end-to-end example separates query generation, graph retrieval, and response synthesis so analysts can trace and verify each reasoning stage. Final answers are grounded in explicit graph evidence rather than opaque neural reasoning.

  • Traceability: Analysts can inspect the generated query, retrieved entities, intermediate traversals, and final grounded response.These artifacts expose the complete graph-grounded inference pipeline.
  • Two-Stage Pipeline: The first LLM converts a natural-language analyst query into executable Cypher, which runs over the BRIDG-ICS knowledge graph.A second, non-fine-tuned LLM summarizes the retrieved graph evidence in human-readable form.
  • Evidence Grounding: Every generated response can be traced to explicit knowledge-graph entities and relationships for verification and auditability.The design supports inspection of returned graph evidence and confirmation that the response is evidence-supported.

7 Discussion

GRICS improves structured CTI reasoning and interpretability across evaluated tasks, but its robustness, scalability, ontology evolution, and human-centred value remain bounded by the study’s evaluation scope. The framework is positioned as analyst decision support rather than autonomous cybersecurity.

  • Neuro-Symbolic Reasoning: GRICS improves CTI reasoning across CTI-RCM and CTI-ATE while using explicit knowledge-graph relationships instead of unstructured pattern matching.The reported gains include structured and semantically grounded reasoning.
  • Robustness: Graph grounding provides some resilience against adversarial prompt injection, but it does not eliminate adversarial vulnerabilities.The ATT&CK-oriented evaluation did not produce the lowest Attack Success Rate.
  • Human–AI Collaboration: GRICS should complement rather than replace expert judgement because cybersecurity recommendations affect safety-critical assets, production continuity, and physical operations.The framework supplies scalable correlation and multi-hop reasoning, while analysts provide context, expertise, and accountability.
  • Explainability: Generated Cypher queries, retrieved entities, and traversal paths support analyst verification and accountable decision-making.These artifacts improve transparency and auditability in safety-critical contexts.
  • Scalability: Performance on substantially larger industrial knowledge graphs has not yet been empirically validated.Scalability depends on graph size, relationship density, reasoning depth, embedding search, and update frequency.
  • Ontology Maintenance: Continuous ontology evolution requires alignment among ontology constraints, graph data, embeddings, and query-generation instructions.The current implementation does not evaluate dynamic ontology evolution.
  • Evaluation Limitations: The study lacks cybersecurity-practitioner evaluation of explanation usefulness, trust, evidence verification, and decision-making efficiency.Cross-framework robustness comparisons also provide qualitative rather than fully controlled quantitative evidence.

8 Conclusion

GRICS combines ontology-based symbolic retrieval with LLM reasoning to provide explainable, traceable, multi-hop threat analysis across Industry 5.0 environments. The framework improves benchmark performance and robustness while supporting analyst inspection of queries, evidence, and reasoning paths.

  • 8 Conclusion: GRICS unifies the BRIDG-ICS ontology, Cypher-based symbolic retrieval, controlled embedding fallback, and LLM answer synthesis in one neuro-symbolic pipeline.The framework targets structurally valid reasoning across tightly coupled IT and OT systems.
  • 8 Conclusion: The framework consistently outperformed baseline LLMs on CTI-RCM and CTI-ATE, with the fine-tuned, graph-enhanced setup performing best.The reported gains concern reasoning accuracy and usability across both benchmarks.
  • 8 Conclusion: Graph-grounded reasoning preserves coherent multi-hop inference better under adversarial and structurally complex queries.The robustness analysis links this behavior to graph-grounded reasoning.
  • 8 Conclusion: The framework exposes intermediate Cypher queries, graph evidence, and reasoning paths, enabling traceability and interpretable Human–AI collaboration.These artifacts support analyst trust and informed decision-making in safety-critical settings.
  • 8 Conclusion: Future work will extend the approach toward symbolic-intelligence digital twins, adaptive retrieval, and real-time cyber–physical threat monitoring.The proposed direction includes real-time risk assessment, attack simulation, and adaptive defence planning.

Declarations

The declarations report public dataset access, funding, testbed and GPU support, generative-AI language assistance, and no competing interests.

  • Declarations: The study’s datasets are publicly accessible through the project’s GitHub repository.The repository is identified as Resellient-Industry-5.0–KG aware Cybersecurity Intelligence Modelling.
  • Declarations: The work was supported by Edith Cowan University’s Australia Early and Mid-Career Research Grant.
  • Declarations: The School of Science provided access to the Industry 5.0 systems testbed and GPU resources.These resources supported LLM-driven knowledge-graph enrichment and fine-tuning.
  • Declarations: The authors used OpenAI ChatGPT for language refinement and grammatical review.
  • Declarations: The authors declare no competing interests.

CRediT authorship contribution statement

The CRediT statement assigns original drafting, review and editing, and project administration responsibilities among the listed authors.

  • CRediT authorship contribution statement: P.N. and A.M. wrote the original draft; A.M., P.N., A.I., I.H.S., and H.J. handled review and editing; A.M. administered the project.
Loading 2609.00604v1…