Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Using Retriever Augmented Large Language Models for Attack Graph Generation

Renascence Tarafder Prapty, Ashish Kundu, Arun Iyengar

TL;DR

This work addresses the challenge of generating comprehensive attack graphs in dynamic cybersecurity landscapes. It introduces CrystalBall, a retriever-augmented generation framework that combines a fine-grained CVE retriever with LLM-driven graph construction to automatically produce attack graphs from CVE descriptions and threat reports. Key contributions include a semantic CVE retrieval model, a relational CVE database with embedded representations, and systematic evaluation of multiple LLMs, with GPT-4 delivering the most detailed graphs and best cross-device chaining. The results demonstrate that context-enhanced prompts and threat-report mining enable scalable, context-rich threat modeling, offering practical benefits for real-time security analysis while underscoring the need for domain validation and ethical considerations.

Abstract

As the complexity of modern systems increases, so does the importance of assessing their security posture through effective vulnerability management and threat modeling techniques. One powerful tool in the arsenal of cybersecurity professionals is the attack graph, a representation of all potential attack paths within a system that an adversary might exploit to achieve a certain objective. Traditional methods of generating attack graphs involve expert knowledge, manual curation, and computational algorithms that might not cover the entire threat landscape due to the ever-evolving nature of vulnerabilities and exploits. This paper explores the approach of leveraging large language models (LLMs), such as ChatGPT, to automate the generation of attack graphs by intelligently chaining Common Vulnerabilities and Exposures (CVEs) based on their preconditions and effects. It also shows how to utilize LLMs to create attack graphs from threat reports.

Using Retriever Augmented Large Language Models for Attack Graph Generation

TL;DR

This work addresses the challenge of generating comprehensive attack graphs in dynamic cybersecurity landscapes. It introduces CrystalBall, a retriever-augmented generation framework that combines a fine-grained CVE retriever with LLM-driven graph construction to automatically produce attack graphs from CVE descriptions and threat reports. Key contributions include a semantic CVE retrieval model, a relational CVE database with embedded representations, and systematic evaluation of multiple LLMs, with GPT-4 delivering the most detailed graphs and best cross-device chaining. The results demonstrate that context-enhanced prompts and threat-report mining enable scalable, context-rich threat modeling, offering practical benefits for real-time security analysis while underscoring the need for domain validation and ethical considerations.

Abstract

As the complexity of modern systems increases, so does the importance of assessing their security posture through effective vulnerability management and threat modeling techniques. One powerful tool in the arsenal of cybersecurity professionals is the attack graph, a representation of all potential attack paths within a system that an adversary might exploit to achieve a certain objective. Traditional methods of generating attack graphs involve expert knowledge, manual curation, and computational algorithms that might not cover the entire threat landscape due to the ever-evolving nature of vulnerabilities and exploits. This paper explores the approach of leveraging large language models (LLMs), such as ChatGPT, to automate the generation of attack graphs by intelligently chaining Common Vulnerabilities and Exposures (CVEs) based on their preconditions and effects. It also shows how to utilize LLMs to create attack graphs from threat reports.
Paper Structure (24 sections, 13 figures, 3 algorithms)

This paper contains 24 sections, 13 figures, 3 algorithms.

Table of Contents

  1. Introduction
  2. Background
  3. CVE
  4. Attack Graph
  5. Proposed System
  6. Pre-Processor
  7. Retriever
  8. LLM Handler
  9. Post-Processor
  10. Implementation
  11. Results
  12. Effect of Context Information in Prompt
  13. Attack Graph from a Threat Report
  14. Comparison among Different LLMs
  15. Attack Graph from Vulnerability Information
  16. ...and 9 more sections

Figures (13)

  • Figure 1: Semi-structured format of a CVE record description
  • Figure 2: Atttack Graph constructed from threat report of SolarWinds Supply Chain Compromise Incident
  • Figure 3: Proposed System Model
  • Figure 4: Retriever Development Phase
  • Figure 5: Attack Graph Generation Steps
  • ...and 8 more figures