GARAGE: Characterizing the Automation Boundary in LLM-based Attack Graph Generation

2026-07-20

AI Summary

Existing automated tools struggle to effectively process unstructured cyber threat intelligence (CTI) and the unique architectures of automotive systems, hindering vehicle-specific attack graph generation. This work proposes GARAGE, a novel framework that integrates retrieval-augmented generation (RAG) with domain-specific automotive security knowledge. Built upon 12,786 CVE entries and 140 incident reports, GARAGE constructs a knowledge base compliant with STIX 2.1 and Auto-ISAC ATM standards, enabling fine-grained kill-chain analysis for tactical-level attack scenario modeling. The approach supports generalization to unseen vehicle architectures and demonstrates accurate knowledge transfer across 320 leave-one-out experiments. Furthermore, it delineates the capability boundaries of large language models in threat analysis and provides cost-performance deployment strategies, thereby enhancing human-machine collaborative TARA processes.

Abstract

While modern vehicle security depends on effective Cyber Threat Intelligence (CTI) synthesis, current automated tools struggle with unstructured data and automotive-specific architectural nuances. To bridge this gap, we introduce GARAGE, a RAG-powered framework that converts fragmented CTI into an actionable, domain-specific knowledge base for automated attack graph generation. GARAGE synthesizes a dataset of 12,786 CVEs and 140 incident reports into a STIX 2.1 and Auto-ISAC ATM-compliant knowledge base. By formalizing tactical-pattern-level scenarios through granular kill chain analysis, GARAGE achieves threat generation capabilities. Our 320 Leave-One-Out experiments reveal that the framework can accurately transfer security knowledge to entirely unseen vehicle architectures. Furthermore, we position GARAGE as a scalable TARA support tool within human-in-the-loop workflows, offering a comprehensive cost-performance analysis to guide its deployment across various LLM tiers.

Problem

• Cyber Threat Intelligence
• Attack Graph Generation
• Automotive Security
• Unstructured Data
• Domain-specific Knowledge

Innovation

• RAG
• Attack Graph Generation
• Automotive Cybersecurity
• Knowledge Base Construction
• TARA