KGV：将大语言模型与知识图谱相结合用于网络威胁情报可信度评估
KGV: Integrating Large Language Models with Knowledge Graphs for Cyber Threat Intelligence Credibility Assessment
AI总结：
针对网络威胁情报可信度仍依赖人工评估的问题，提出融合LLM与段落级语义知识图谱的KGV框架，并发布CTI-200数据集，显著提升评估性能与响应速度。
摘要：
网络威胁情报（CTI）是预防复杂、有组织且武器化网络攻击的关键工具。然而，很少有研究关注CTI的可信度评估，这项工作仍需网络安全专家进行人工分析。本文提出了基于知识图谱的验证器（Knowledge Graph-based Verifier，KGV），这是首个将大语言模型（LLM）与简单结构化知识图谱（KG）相结合、用于自动化CTI可信度评估的框架。与以实体为中心的KG不同，KGV构建段落级语义图，其中节点表示通过相似性分析连接的文本片段，从而有效增强模型的语义理解能力，降低KG密度并大幅提升响应速度。实验结果表明，KGV在CTI-200数据集上优于最先进的事实推理方法，F1提升5.7%。此外，它在事实问答和假新闻检测数据集上表现出强大的可扩展性。与等长文本的基于实体的知识图谱（KG）相比，我们结构简单的KG将节点数量减少近三分之二，同时精确率提高1.7%，响应时间缩短46.7%。此外，我们创建并公开发布了首个CTI可信度评估数据集CTI-200。与CTI识别数据集不同，CTI-200细化了CTI摘要和关键句，专门聚焦可信度评估。
英文摘要：
Cyber threat intelligence (CTI) is a crucial tool to prevent sophisticated, organized, and weaponized cyber attacks. However, few studies have focused on the credibility assessment of CTI, and this work still requires manual analysis by cybersecurity experts. In this paper, we propose Knowledge Graph-based Verifier (KGV), the first framework integrating large language models (LLMs) with simple structured knowledge graphs (KGs) for automated CTI credibility assessment. Unlike entity-centric KGs, KGV constructs paragraph-level semantic graphs where nodes represent text segments connected through similarity analysis, which effectively enhances the semantic understanding ability of the model, reduces KG density and greatly improves response speed. Experimental results demonstrate that our KGV outperforms state-of-the-art fact reasoning methods on the CTI-200 dataset, achieving a 5.7\% improvement in F1. Additionally, it shows strong scalability on factual QA and fake news detection datasets. Compared to entity-based knowledge graphs (KGs) for equivalent-length texts, our structurally simple KG reduces node quantities by nearly two-thirds while boosting precision by 1.7\% and cutting response time by 46.7\%. In addition, we have created and publicly released the first CTI credibility assessment dataset, CTI-200. Distinct from CTI identification datasets, CTI-200 refines CTI summaries and key sentences to focus specifically on credibility assessment.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
