Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence

Official implementation for the paper "Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence"

Anonymous repository. Will be migrated to a permanent GitHub repo with DOI via Zenodo upon acceptance.

---

Overview

This repository provides full reproduction code for our large-scale empirical study of LLM failure modes in Cyber Threat Intelligence (CTI) reasoning. We identify three domain-specific vulnerability categories:

---

Repository Structure

llm-cti/
├── src/
│   ├── data/
│   │   ├── dataset_loader.py          # Load & unify CTIBench, SevenLLM, SWE-Bench, CyberTeam
│   │   ├── realworld_collector.py     # Collect from NVD, CISA, MISP, VirusTotal, OTX
│   │   ├── preprocessor.py            # Normalize & unify benchmark instances into CTI scenarios
│   │   └── benchmark_stats.py         # Dataset statistics (Table 9)
│   ├── models/
│   │   ├── model_registry.py          # Registry of all evaluated LLMs (Table 2)
│   │   ├── general_llms.py            # GPT-5, Claude Sonnet 4, Gemini 2.5, etc.
│   │   ├── cyber_llms.py              # FoundationSec, Cyber-Zero, ZySec, etc.
│   │   └── prompt_templates.py        # Evaluation prompt structure (Appendix B.6)
│   ├── evaluation/
│   │   ├── cti_evaluator.py           # Main evaluator across all 4 CTI stages
│   │   ├── metrics.py                 # F1, Accuracy, BLEU, AUC, NDCG
│   │   ├── contextualization.py       # Stage 1 task evaluations
│   │   ├── attribution.py             # Stage 2 task evaluations
│   │   ├── prediction.py              # Stage 3 task evaluations
│   │   └── mitigation.py              # Stage 4 task evaluations
│   ├── categorization/
│   │   ├── stratified_sampler.py      # Algorithm 1: Stratified failure sampling (RQ1)
│   │   ├── failure_mode_taxonomy.py   # Algorithm 2: Autoregressive failure mode determination (RQ2)
│   │   ├── human_in_loop.py           # Algorithm 3: Multi-agent + human-in-loop categorization (RQ3)
│   │   └── vulnerability_types.py     # Definitions & detection logic for all 15 subtypes
│   ├── mitigation/
│   │   ├── causal_intervention.py     # C³ counterfactual consistency check (§5.1)
│   │   ├── spurious_correlation.py    # Mitigations for types 1.1–1.5
│   │   ├── contradictory_knowledge.py # Mitigations for types 2.1–2.6
│   │   ├── constrained_generalization.py # Mitigations for types 3.1–3.4
│   │   └── retrieval_filters.py       # Retrieval-time filtering strategies
│   └── utils/
│       ├── logger.py                  # Logging utilities
│       ├── cache.py                   # API call caching
│       ├── ioc_normalizer.py          # IOC canonicalization
│       └── entity_resolver.py         # Alias resolution for threat actors/malware
├── configs/
│   ├── models.yaml                    # Model API configs
│   ├── evaluation.yaml                # Evaluation settings
│   └── mitigation.yaml                # Mitigation strategy configs
├── scripts/
│   ├── run_evaluation.sh              # Full evaluation pipeline
│   ├── run_categorization.sh          # Failure categorization pipeline
│   ├── run_mitigation.sh              # Mitigation experiments
│   └── run_ablation.sh                # Ablation study
├── tests/
│   ├── test_metrics.py
│   ├── test_categorization.py
│   └── test_mitigation.py
├── notebooks/
│   ├── 01_dataset_exploration.ipynb
│   ├── 02_evaluation_results.ipynb
│   ├── 03_vulnerability_analysis.ipynb
│   └── 04_mitigation_results.ipynb
├── results/                           # Output directory for experiment results
├── requirements.txt
├── setup.py
└── README.md

---

Installation

git clone https://github.com/anonymous/llm-cti
cd llm-cti
pip install -e .

Or install dependencies directly:

pip install -r requirements.txt

API Keys

Set the following environment variables for the models you plan to use:

export OPENAI_API_KEY="your-openai-key"
export ANTHROPIC_API_KEY="your-anthropic-key"
export GOOGLE_API_KEY="your-google-key"
export XAI_API_KEY="your-xai-key"           # For Grok
export NVD_API_KEY="your-nvd-key"           # Optional, increases rate limit
export VT_API_KEY="your-virustotal-key"     # For VirusTotal enrichment
export OTX_API_KEY="your-otx-key"           # For AlienVault OTX

---

Quick Start

1. Data Collection & Preprocessing

# Download and preprocess all benchmarks
python -m src.data.dataset_loader --output_dir data/benchmarks

# Collect real-world threat data from NVD, CISA, MISP, OTX
python -m src.data.realworld_collector --output_dir data/realworld

# Preprocess and unify into CTI scenarios
python -m src.data.preprocessor \
    --benchmark_dir data/benchmarks \
    --realworld_dir data/realworld \
    --output_dir data/processed

2. Run Full Evaluation (Table 2)

# Evaluate all models on all CTI tasks
bash scripts/run_evaluation.sh

# Or run a single model
python -m src.evaluation.cti_evaluator \
    --model gpt-5 \
    --data_dir data/processed \
    --output_dir results/evaluation \
    --stages contextualization attribution prediction mitigation

3. Categorize Failures (Section 3 / Figure 2)

bash scripts/run_categorization.sh

# Or run each step separately:
# Step 1: Stratified failure sampling
python -m src.categorization.stratified_sampler \
    --eval_results results/evaluation \
    --output_dir results/failures

# Step 2: Failure mode determination (iterative)
python -m src.categorization.failure_mode_taxonomy \
    --failures results/failures \
    --output_dir results/taxonomy

# Step 3: Multi-agent + human-in-loop categorization
python -m src.categorization.human_in_loop \
    --taxonomy results/taxonomy \
    --output_dir results/categorized

4. Run Causal Intervention & Mitigations (Section 5)

bash scripts/run_mitigation.sh

# Causal intervention (C³) across all tasks
python -m src.mitigation.causal_intervention \
    --eval_results results/evaluation \
    --output_dir results/mitigation/causal

# Fine-grained mitigations per vulnerability subtype
python -m src.mitigation.spurious_correlation --subtype all
python -m src.mitigation.contradictory_knowledge --subtype all
python -m src.mitigation.constrained_generalization --subtype all

5. Ablation Study (Table 4)

bash scripts/run_ablation.sh

---

Evaluated Models

General-Purpose LLMs

Cybersecurity-Specialized Models

---

CTI Stages & Tasks

---

Vulnerability Taxonomy

Spurious Correlation (SC)
├── 1.1 Co-mention bias from raw threat incidents
├── 1.2 Exploitation bias from deliberately reused IoCs
├── 1.3 Confounding factors (explicit/implicit entity correlation)
├── 1.4 Skewed source representation
└── 1.5 Hierarchical metadata from attack chains

Contradictory Knowledge (CK)
├── 2.1 Temporal contradiction (outdated vs. recent evidence)
├── 2.2 Conflicting reports of attack contexts/dependencies
├── 2.3 Semantic conflict (naming/taxonomy divergence)
├── 2.4 Divergent data structures across platforms
├── 2.5 Misaligned knowledge and security standards
└── 2.6 Counteracting CTI generation and LLM alignment

Constrained Generalization (CG)
├── 3.1 Distributional bias
├── 3.2 Unseen patterns from emerging threats
├── 3.3 Overfitted reasoning
└── 3.4 Environmental unawareness

---

Reproducing Key Results

Table 2 — Model Performance on CTI Tasks

python scripts/reproduce_table2.py --output results/table2.csv

Figure 2 — Vulnerability Distribution

python scripts/reproduce_figure2.py --output results/figure2.pdf

Table 6 — Causal Intervention Gains

python scripts/reproduce_table6.py --output results/table6.csv

Table 7 — Mitigation Results

python scripts/reproduce_table7.py --output results/table7.csv

---

License

This project is licensed under the MIT License — see LICENSE for details.