OntoLogX：基于大型语言模型的面向网络安全日志的知识图谱提取
OntoLogX: Ontology-Guided Knowledge Graph Extraction from Cybersecurity Logs with Large Language Models
AI总结：
OntoLogX利用大型语言模型和知识图谱技术，从网络安全日志中提取结构化信息，通过检索增强生成和迭代校正，生成符合语义的知识图谱，并预测MITRE ATT&CK战术。
摘要：
系统日志是获取网络威胁情报（CTI）的重要来源，记录攻击者行为、利用的漏洞和恶意活动痕迹。然而，其效用常受限于缺乏结构、语义不一致和跨设备和会话的碎片化。提取可操作的CTI需要能够将嘈杂、异构的数据整合为一致且互操作的表示的方法。我们介绍了OntoLogX，一个自主的人工智能代理，利用大型语言模型（LLMs）将原始日志转换为基于本体的知识图谱（KGs）。OntoLogX整合了轻量级的日志本体与检索增强生成（RAG）和迭代校正步骤，确保生成的KGs在语法和语义上都有效。除了事件级分析外，系统将KGs聚合到会话中，并利用LLM预测MITRE ATT&CK战术，将低层次日志证据链接到更高层次的对抗目标。我们评估了OntoLogX在公共基准数据集和真实世界蜜罐数据集上的表现，展示了在多个KG后端中的稳健KG生成能力和对抗活动到ATT&CK战术的准确映射。结果突显了检索和校正对精确度和召回率的益处，代码导向模型在结构化日志分析中的有效性，以及基于本体的表示在可操作CTI提取中的价值。
英文摘要：
System logs represent a valuable source of Cyber Threat Intelligence (CTI), capturing attacker behaviors, exploited vulnerabilities, and traces of malicious activity. Yet their utility is often limited by lack of structure, semantic inconsistency, and fragmentation across devices and sessions. Extracting actionable CTI from logs therefore requires approaches that can reconcile noisy, heterogeneous data into coherent and interoperable representations. We introduce OntoLogX, an autonomous Artificial Intelligence (AI) agent that leverages Large Language Models (LLMs) to transform raw logs into ontology-grounded Knowledge Graphs (KGs). OntoLogX integrates a lightweight log ontology with Retrieval Augmented Generation (RAG) and iterative correction steps, ensuring that generated KGs are syntactically and semantically valid. Beyond event-level analysis, the system aggregates KGs into sessions and employs a LLM to predict MITRE ATT&CK tactics, linking low-level log evidence to higher-level adversarial objectives. We evaluate OntoLogX on both logs from a public benchmark and a real-world honeypot dataset, demonstrating robust KG generation across multiple KGs backends and accurate mapping of adversarial activity to ATT&CK tactics. Results highlight the benefits of retrieval and correction for precision and recall, the effectiveness of code-oriented models in structured log analysis, and the value of ontology-grounded representations for actionable CTI extraction.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
