Auto Threat AI: An Agentic and Explainable Framework for Automated Cyber Threat Intelligence Extraction

Abstract

Cyber Threat Intelligence (CTI) enables Security Operations Centers (SOCs) to understand adversary behavior, prioritize risks, and respond to cyber threats. However, cur-rent CTI workflows still depend heavily on manual analysis of unstructured threat reports, vulnerability advisories, open-source intelligence, social media posts, and structured feeds. This creates operational latency, inconsistent extraction quality, weak provenance, and limited scalability. This paper presents Auto Threat AI, an agentic and explainable framework for automated CTI extraction, correlation, scoring, and analyst-governed SOC operationalization. The proposed framework integrates determin-istic indicator extraction, Natural Language Processing (NLP), schema-guided Large Language Model (LLM) agents, graph-aware threat correlation, bounded risk scoring, evidence-first explainability, and Human-in-the-Loop (HITL) governance. The system ingests heterogeneous CTI sources, extracts entities and relations such as IOCs, CVEs, malware, campaigns, threat actors, tools, and techniques, constructs a threat knowledge graph, gen-erates campaign candidates, and presents risk-ranked intelligence through a SOC dashboard. Experimental evaluation on safe demonstration CTI data shows that the implemented prototype ingested 6 sources, extracted 36 entities, generated 33 relations, detected 11 threat events, identified 5 campaign candidates, and routed 8 items for HITL review. The results demonstrate that Auto Threat AI can reduce manual CTI processing effort while improving traceability, explainability, and analyst trust.

Introduction

The paper presents Auto Threat AI, a governed framework for automated Cyber Threat Intelligence (CTI) extraction and analysis that helps Security Operations Centers (SOCs) transform unstructured threat reports into actionable intelligence. Modern cyberattacks are increasingly sophisticated, involving multiple stages such as reconnaissance, exploitation, credential theft, lateral movement, and ransomware. Although CTI is widely shared through reports, blogs, advisories, and structured formats like STIX and TAXII, much of it remains in natural language, requiring time-consuming manual analysis.

Auto Threat AI addresses this challenge by combining deterministic indicator extraction, Natural Language Processing (NLP), Large Language Models (LLMs), knowledge graphs, risk scoring, explainability, and Human-in-the-Loop (HITL) validation. Unlike unrestricted AI systems, the framework is designed for defensive cybersecurity only and does not generate exploits, malware, phishing content, or unauthorized scanning activities. Instead, it produces evidence-linked, structured intelligence that analysts can review before operational use.

The proposed architecture follows a layered workflow consisting of CTI ingestion and normalization, entity extraction, relation extraction, agentic reasoning, knowledge graph construction, risk scoring, explainability, HITL validation, and SOC dashboard integration. It extracts both technical indicators (such as IP addresses, domains, URLs, file hashes, and CVEs) and high-level entities (including malware families, threat actors, campaigns, tools, vendors, and ATT&CK techniques). The extracted entities and their relationships are represented with supporting evidence, confidence scores, and source information to preserve provenance.

A key component is the agentic intelligence layer, which consists of specialized AI agents responsible for threat extraction, entity correlation, campaign analysis, mitigation recommendation, trust scoring, governance enforcement, and analyst-friendly summarization. The framework supports optional LLM integration, but when external LLM services are unavailable, it uses a mock LLM that generates safe, schema-compliant outputs based solely on existing evidence, preventing unsupported intelligence generation.

The preprocessing module cleans and normalizes CTI data, including de-obfuscating indicators such as modified URLs and assigning evidence identifiers to maintain traceability. The framework also constructs a threat knowledge graph that connects indicators, vulnerabilities, malware, campaigns, threat actors, and attack techniques, enabling richer contextual analysis and investigation.

Conclusion

This paper presented Auto Threat AI, an agentic and explainable framework for automated CTI extraction and SOC operationalization. The proposed system integrates data ingestion, preprocessing, entity extraction, relation extraction, event detection, LLM agent abstraction, knowledge graph construction, graph-aware correlation, risk scoring, explainability, HITL governance, dashboard visualization, and audit logging. Evaluation results show that the framework successfully processes heterogeneous CTI sources and produces structured, risk-ranked, and explainable intelligence. Future work will focus on integrating live STIX/TAXII feeds, improving LLM-based relation reasoning, deploying a scalable graph database, applying graph neural networks for correlation, supporting multimodal intelligence, and strengthening explainability auditing. The framework can also be extended into an autonomous SOC assistant for alert triage, detection recommendation, and incident summarization, while preserving strict governance and human approval for high-impact actions.

References

[1] M. Hutchins, M. J. Cloppert, and R. M. Amin, “Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains,” in Proc. 6th Int. Conf. Information Warfare and Security, 2011, pp. 113–125. [2] MITRE, “MITRE ATT&CK: Adversarial tactics, techniques, and com-mon knowledge,” 2026. [Online]. Available: https://attack.mitre.org/ [3] OASIS Cyber Threat Intelligence Technical Committee, “STIX Version 2.1 ,” OASIS Committee Specification, 2021. [4] OASIS Cyber Threat Intelligence Technical Committee, “TAXII Version 2.1,” OASIS Committee Specification, 2021. [5] A. Vaswani et al., “Attention is all you need,” in Advances in Neural Information Processing Systems, 2017, pp. 5998–6008. [6] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of deep bidirectional transformers for language understanding,” in Proc. NAACL-HLT, 2019, pp. 4171–4186. [7] M. T. Ribeiro, S. Singh, and C. Guestrin, “Why should I trust you?: Explaining the predictions of any classifier,” in Proc. ACM SIGKDD, 2016, pp. 1135–1144. [8] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in Advances in Neural Information Processing Systems, 2017, pp. 4765–4774. [9] National Institute of Standards and Technology, “Computer Security Incident Handling Guide,” NIST Special Publication 800-61 Revision 2, 2012. [10] C. Sabottke, O. Suciu, and T. Dumitras, “Vulnerability disclosure in the age of social media: Exploiting Twitter for predicting real-world exploits,” in Proc. 24th USENIX Security Symposium, 2015, pp. 1041–1056. [11] P. Gao et al., “ThreatKG: An automated system for building knowledge graphs from cybersecurity texts,” in Proc. IEEE Int. Conf. Big Data, 2021, pp. 3614–3623. [12] M. Husari et al., “TTPDrill: Automatic and accurate extraction of threat actions from unstructured text of CTI sources,” in Proc. ACM ACSAC, 2017, pp. 103–115.

Copyright

Copyright © 2026 Methari Keeravani, N. Shiva Lingam. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.