Schema-Agnostic Knowledge Graph Construction via Hybrid Ontology Discovery for Cyber Threat Intelligence

2026-05-31

AI Summary

This work addresses critical limitations in current cyber threat intelligence (CTI) knowledge graph construction methods, which rely on rigid ontology schemas that struggle to accommodate structural evolution and exhibit poor scalability over large ontologies, while cloud-based large language model (LLM) APIs introduce significant privacy concerns. To overcome these challenges, the authors propose ANCHOR, a novel system featuring a hybrid ontology discovery mechanism that integrates dynamic ontology navigation with SHACL-based semantic validation, enabling automatic knowledge graph construction independent of predefined schemas. ANCHOR further supports local deployment of large language models, ensuring data privacy while achieving high-accuracy ontology type inference. Experimental results demonstrate that ANCHOR substantially outperforms existing approaches across multiple CTI ontologies—including UCO, STIX, and MALOnt—delivering superior performance in both type recognition accuracy and schema compliance, with its local LLM variant closely matching the effectiveness of enterprise-grade API solutions.

Abstract

Cyber threat intelligence (CTI) reports now serve as essential resources for capturing adversary tactics, techniques, and procedures observed in modern attack campaigns. While traditional CTI platforms reduce this intelligence to isolated indicators through fixed schemas such as STIX, ontology-based representations preserve the semantic relationships needed for structured threat analysis. However, existing approaches for ontology-aligned CTI extraction face three challenges: (i) schema-specific pipelines that require manual reconfiguration whenever the schema changes, (ii) prompt-based schema inclusion that fails to scale on large ontologies such as UCO, and (iii) reliance on enterprise LLM APIs that conflicts with privacy constraints when integrating sensitive internal incident data. In this paper, we present ANCHOR, a schema-agnostic CTI knowledge graph construction system that bridges LLMs and formal ontology schemas. At the core of ANCHOR is hybrid ontology discovery, a search-and-navigate mechanism that dynamically explores large-scale ontology schemas, combined with SHACL-based validation to enforce schema-compliant type assignments. Experimental results on the UCO, STIX, and MALOnt schemas show that ANCHOR outperforms existing baselines in ontology typing and schema compliance. In addition, ANCHOR with a local LLM closely matches enterprise LLM typing performance, enabling privacy-preserving CTI analysis with high fidelity.

Problem

• Cyber Threat Intelligence
• Knowledge Graph Construction
• Ontology Alignment
• Schema-Agnostic
• Privacy Preservation

Innovation

• schema-agnostic
• hybrid ontology discovery
• SHACL-based validation
• local LLM
• cyber threat intelligence