REVIEW 6 cited by
Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
Many public sources of cyber threat and vulnerability information exist to help defend cyber systems. This paper links MITRE's ATT&CK MATRIX of Tactics and Techniques, NIST's Common Weakness Enumerations (CWE), Common Vulnerabilities and Exposures (CVE), and Common Attack Pattern Enumeration and Classification list (CAPEC), to gain further insight from alerts, threats and vulnerabilities. We preserve all entries and relations of the sources, while enabling bi-directional, relational path tracing within an aggregate data graph called BRON. In one example, we use BRON to enhance the information derived from a list of the top 10 most frequently exploited CVEs. We identify attack patterns, tactics, and techniques that exploit these CVEs and also uncover a disparity in how much linked information exists for each of these CVEs. This prompts us to further inventory BRON's collection of sources to provide a view of the extent and range of the coverage and blind spots of public data sources.
Forward citations
Cited by 6 Pith papers
-
Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion
A classifier trained on 1,207 expert-mapped CVEs roughly doubles recall@5 over a zero-shot baseline, while LLM-generated labels at ~0.39 expert agreement provide no reliable gain and degrade rare-technique coverage at...
-
TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs
A knowledge-graph claim-governance layer raises gold-aligned precision of multi-setup TTP mappings from 25.3% to 90.6% while preserving full provenance and non-destructive trust history.
-
Benchmarking LLM-Assisted Blue Teaming via Standardized Threat Hunting
Standardized modular threat-hunting workflows (CyberTeam) improve LLM performance on blue team tasks compared to open-ended ICL, CoT, and ToT prompting across 30 tasks and 452k samples.
-
The Role of Visualization in LLM-Assisted Knowledge Graph Systems: Effects on User Trust, Exploration, and Workflows
Visualizations designed to increase transparency in an LLM-based knowledge graph query tool actually led users, including experts, to overtrust incorrect outputs.
-
From Attack Descriptions to Vulnerabilities: A Sentence Transformer-Based Approach
A sentence-transformer benchmark finds MMPNet best links ATT&CK attack technique descriptions to CVE vulnerability records (F1=89) and proposes 275 manually vetted new links.
-
Large Language Models for Security Operations Centers: A Comprehensive Survey
A systematic review of 138 papers classifying LLM applications in SOC workflows by phase, model family, datasets, and maturity.
Discussion (0). Sign in to comment.