An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

2026-07-22

AI Summary

This work addresses the limitation of current cyber threat intelligence (CTI) reports, which lack explicit modeling of preconditions and state changes associated with attack steps, thereby hindering automated reachability analysis of multi-stage attack chains. To overcome this, the authors propose the first approach that explicitly models preconditions and postconditions during CTI extraction, representing each step as a structured attack unit comprising precondition, action, and postcondition. A large language model–driven multi-stage pipeline is employed to extract, normalize, and repair dependencies among these units, which are then compiled into Datalog rules for logical reasoning. Evaluation on 20 CTI reports containing 334 manually annotated steps demonstrates superior coverage in attack behavior extraction compared to existing systems; logical reasoning successfully reached the target in 19 reports, and backward search generated 34 valid attack paths.

Abstract

Cyber Threat Intelligence (CTI) reports richly describe real-world attack processes, but their unstructured narratives cannot be directly used for automated attack-path reasoning. Existing CTI extraction methods focus on indicators, entities, or TTP labels without modeling the execution conditions and resulting states of each attack step, so the extracted knowledge supports neither state matching nor reachability analysis across multi-stage attack chains. This paper proposes an automated framework that extracts reachable attack chains by modeling each attack step as an attack unit of preconditions, an attack behavior, and postconditions. A multi-stage pipeline assisted by large language models (LLMs) extracts attack behavior skeletons, recovers their preconditions and postconditions, normalizes them into predefined predicates, and repairs broken dependencies; the resulting units are compiled into Datalog-style rules for attack-goal reachability reasoning. On a dataset of 20 CTI reports containing 334 human-validated annotated steps, our framework achieves higher annotated-step coverage than representative CTI extraction systems in recovering attack behaviors. Moreover, by explicitly generating preconditions and postconditions, it produces attack units that are more complete and consistent than those generated by end-to-end LLM baselines. On the extracted chains, Datalog inference reaches the specified attack goal in 19 of 20 reports, while backward search yields 34 attack paths under the generated rules. The source code and experimental artifacts are available in an anonymized repository. .

Problem

• Cyber Threat Intelligence
• Attack Chains
• Reachability Analysis
• Preconditions and Postconditions
• Automated Reasoning

Innovation

• Attack Chain Extraction
• Cyber Threat Intelligence
• Precondition-Postcondition Modeling
• Large Language Models
• Datalog Reasoning