Search papers, labs, and topics across Lattice.
TRACE-CTI is a governance framework designed to enhance the trustworthiness of Cyber Threat Intelligence (CTI) mappings to the MITRE ATT&CK framework by preserving evidence, provenance, and validation history of extractor outputs. The framework aggregates predictions into GraphAssertions and ConsensusAssertions, ensuring that only policy-compliant assertions are exposed, while maintaining detailed evidence granularity and a comprehensive revocation history. Evaluation on two CTI corpora shows that increasing the number of supporting setups significantly improves precision from 25.3% to 90.6%, although at the cost of recall, highlighting the framework's capability to provide auditable governance of TTP claims.
Increasing setup support can boost the precision of CTI mappings to nearly 91%, but at a significant trade-off in recall.
Security Operations Centers increasingly rely on automated mapping of Cyber Threat Intelligence reports to MITRE ATT&CK, yet extractor outputs remain fallible and are often stored without the evidence, provenance, and validation history needed to decide whether an individual mapping should be trusted. We present TRACE- CTI, a post-extraction claim-governance framework that preserves run-level Predictions, aggregates them into configuration-level GraphAssertions, materializes setup-deduplicated corroboration as ConsensusAssertions, and exposes only GraphAssertions backed by policy-compliant validation grounds. The framework retains native evidence granularity, complete extraction provenance, versioned trust decisions, and non-destructive revocation history. We evaluate TRACE-CTI on two public CTI corpora comprising 65 reports and 5,303 sentences, using a controlled 2 x 3 matrix of retrievers and generator families, incrementally ingested across six GraphVersions. All setups are incorporated without schema modification; provenance paths remain complete, operational scopes remain disjoint, and every trusted GraphAssertion has an active qualifying validation ground. Cross-generator-family setup pairs exhibit greater output diversity than same-family pairs. At the final graph state, increasing setup support from k>= 1 to six-setup unanimity raises gold-aligned precision from 25.3% to 90.6%, while recall decreases from 88.2% to 16.3%. The graph also directly answers seven questions about provenance, trust, versioning, dependency, disagreement, and review-queue that the evaluated minimal flat output cannot fully answer without enrichment or reprocessing. These results support explicit, auditable governance of extracted TTP claims; the observed corroboration trajectory is descriptive and does not establish statistical independence or a causal model-family effect.
