TITAN: Graph-Executable Reasoning for Cyber Threat Intelligence
This addresses the need for automated and interpretable reasoning in cyber threat intelligence, offering a novel approach for security analysts, though it is incremental in combining existing techniques like knowledge graphs and path planning.
The paper tackles the problem of connecting natural-language cyber threat queries with executable reasoning by introducing TITAN, a framework that integrates a path planner and graph executor over a structured knowledge graph, achieving results such as generating syntactically valid and semantically coherent reasoning paths on a dataset of 88,209 examples.
TITAN (Threat Intelligence Through Automated Navigation) is a framework that connects natural-language cyber threat queries with executable reasoning over a structured knowledge graph. It integrates a path planner model, which predicts logical relation chains from text, and a graph executor that traverses the TITAN Ontology to retrieve factual answers and supporting evidence. Unlike traditional retrieval systems, TITAN operates on a typed, bidirectional graph derived from MITRE, allowing reasoning to move clearly and reversibly between threats, behaviors, and defenses. To support training and evaluation, we introduce the TITAN Dataset, a corpus of 88209 examples (Train: 74258; Test: 13951) pairing natural language questions with executable reasoning paths and step by step Chain of Thought explanations. Empirical evaluations show that TITAN enables models to generate syntactically valid and semantically coherent reasoning paths that can be deterministically executed on the underlying graph.