Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports

2026-09-08

AI Summary

为解决手动生成威胁狩猎线索效率低的问题，本文提出AHLERT系统，通过混合检索与本体基础的生成方法自动从CTI报告中提取相关线索。

Abstract

Threat hunting increasingly depends on converting unstructured knowledge (e.g., Cyber Threat Intelligence reports) into actionable hunt leads: concise, investigable hypotheses grounded in observable artifacts and adversary techniques. Producing such leads manually is a tedious and hard-to-scale task. Existing automated approaches stop at the entity layer, ignore the defender's operational environment, and analyze each report in isolation. To address these gaps, we introduce AHLERT, a system that automatically extracts relevant, environment-aware, and hunt leads from threat reports through (i) a hybrid retriever that combines dense vector search with multi-hop traversal over a knowledge graph seeded with MITRE ATT&CK; (ii) an ontology-grounding retrieval-augmented generation method that constrains each lead to the defender's own assets and controls; and (iii) an LLM-agnostic framework that emits structured, directly actionable leads rather than loose indicators of compromise. We evaluate AHLERT on public CTI reports for well-known APTs across multiple proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 by ~2x (0.44 to 0.85) over a single-route flat-RAG baseline, and AHLERT attains the highest effectiveness score (~86.95%) compared with off-the-shelf LLM models.

Problem

• Threat Hunting
• Cyber Threat Intelligence
• Hunt Leads
• Operational Environment
• Automated Approaches

Innovation

• Hybrid Retriever
• Ontology-Grounded Retrieval-Augmented Generation
• Environment-Aware Hunt Leads