Search papers, labs, and topics across Lattice.
This paper introduces ANCHOR, a schema-agnostic knowledge graph construction system designed to enhance cyber threat intelligence (CTI) by integrating large language models (LLMs) with formal ontology schemas. The system addresses key challenges in traditional CTI platforms, such as the limitations of schema-specific pipelines and privacy concerns associated with enterprise LLM APIs. Experimental results demonstrate that ANCHOR significantly outperforms existing methods in ontology typing and schema compliance while maintaining high fidelity in privacy-preserving CTI analysis.
ANCHOR enables seamless integration of large-scale ontologies into cyber threat intelligence, outperforming traditional methods while ensuring data privacy.
Cyber threat intelligence (CTI) reports now serve as essential resources for capturing adversary tactics, techniques, and procedures observed in modern attack campaigns. While traditional CTI platforms reduce this intelligence to isolated indicators through fixed schemas such as STIX, ontology-based representations preserve the semantic relationships needed for structured threat analysis. However, existing approaches for ontology-aligned CTI extraction face three challenges: (i) schema-specific pipelines that require manual reconfiguration whenever the schema changes, (ii) prompt-based schema inclusion that fails to scale on large ontologies such as UCO, and (iii) reliance on enterprise LLM APIs that conflicts with privacy constraints when integrating sensitive internal incident data. In this paper, we present ANCHOR, a schema-agnostic CTI knowledge graph construction system that bridges LLMs and formal ontology schemas. At the core of ANCHOR is hybrid ontology discovery, a search-and-navigate mechanism that dynamically explores large-scale ontology schemas, combined with SHACL-based validation to enforce schema-compliant type assignments. Experimental results on the UCO, STIX, and MALOnt schemas show that ANCHOR outperforms existing baselines in ontology typing and schema compliance. In addition, ANCHOR with a local LLM closely matches enterprise LLM typing performance, enabling privacy-preserving CTI analysis with high fidelity.
