TITAN: Graph-Executable Reasoning for Cyber Threat Intelligence
Marco Simoni, Aleksandar Fontana, Andrea Saracino, Paolo Mori
TL;DR
The paper tackles the challenge of multi-hop, relational reasoning in Cyber Threat Intelligence by bridging natural-language queries with executable reasoning over a structured, typed, bidirectional knowledge graph. It introduces TITAN, a two-component framework consisting of a path-planner LLM and a graph executor that operate on the TITAN Ontology-derived KG, enabling deterministic traversal and reasoning. A large TITAN Dataset with 88,209 NLQ-CoT examples supports training and evaluation, demonstrating that Chain-of-Thought guidance yields higher path accuracy and more coherent reasoning than non-CoT baselines, especially for longer, multi-hop queries. The work offers a transparent, scalable approach to CTI reasoning and outlines concrete directions for ontology expansion, dataset enrichment, and alignment-based improvements to enhance interpretability and practicality.
Abstract
TITAN (Threat Intelligence Through Automated Navigation) is a framework that connects natural-language cyber threat queries with executable reasoning over a structured knowledge graph. It integrates a path planner model, which predicts logical relation chains from text, and a graph executor that traverses the TITAN Ontology to retrieve factual answers and supporting evidence. Unlike traditional retrieval systems, TITAN operates on a typed, bidirectional graph derived from MITRE, allowing reasoning to move clearly and reversibly between threats, behaviors, and defenses. To support training and evaluation, we introduce the TITAN Dataset, a corpus of 88209 examples (Train: 74258; Test: 13951) pairing natural language questions with executable reasoning paths and step by step Chain of Thought explanations. Empirical evaluations show that TITAN enables models to generate syntactically valid and semantically coherent reasoning paths that can be deterministically executed on the underlying graph.