{"id":"https://openalex.org/W7124423884","doi":"https://doi.org/10.1186/s42400-025-00505-y","title":"CTI-Thinker: an LLM-driven system for CTI knowledge graph construction and attack reasoning","display_name":"CTI-Thinker: an LLM-driven system for CTI knowledge graph construction and attack reasoning","publication_year":2026,"publication_date":"2026-01-16","ids":{"openalex":"https://openalex.org/W7124423884","doi":"https://doi.org/10.1186/s42400-025-00505-y"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-025-00505-y","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00505-y","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00505-y.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00505-y.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5110378069","display_name":"Xiuzhang Yang","orcid":null},"institutions":[{"id":"https://openalex.org/I178232147","display_name":"Guizhou University","ror":"https://ror.org/02wmsc916","country_code":"CN","type":"education","lineage":["https://openalex.org/I178232147"]},{"id":"https://openalex.org/I4210160692","display_name":"Guizhou Academy of Sciences","ror":"https://ror.org/05ty2n298","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210160692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiuzhang Yang","raw_affiliation_strings":["State Key Laboratory of Public Big Data (Guizhou Big Data Academy), Guizhou University, Guiyang, 550025, People\u2019s Republic of China"],"affiliations":[{"raw_affiliation_string":"State Key Laboratory of Public Big Data (Guizhou Big Data Academy), Guizhou University, Guiyang, 550025, People\u2019s Republic of China","institution_ids":["https://openalex.org/I178232147","https://openalex.org/I4210160692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123177929","display_name":"Ruijie Zhong","orcid":null},"institutions":[{"id":"https://openalex.org/I178232147","display_name":"Guizhou University","ror":"https://ror.org/02wmsc916","country_code":"CN","type":"education","lineage":["https://openalex.org/I178232147"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ruijie Zhong","raw_affiliation_strings":["College of Computer Science and Technology, Guizhou University, Guiyang, 550025, People\u2019s Republic of China"],"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Guizhou University, Guiyang, 550025, People\u2019s Republic of China","institution_ids":["https://openalex.org/I178232147"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100722817","display_name":"Yuling Chen","orcid":"https://orcid.org/0000-0002-8674-8356"},"institutions":[{"id":"https://openalex.org/I178232147","display_name":"Guizhou University","ror":"https://ror.org/02wmsc916","country_code":"CN","type":"education","lineage":["https://openalex.org/I178232147"]},{"id":"https://openalex.org/I4210160692","display_name":"Guizhou Academy of Sciences","ror":"https://ror.org/05ty2n298","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210160692"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Yuling Chen","raw_affiliation_strings":["College of Computer Science and Technology, Guizhou University, Guiyang, 550025, People\u2019s Republic of China","State Key Laboratory of Public Big Data (Guizhou Big Data Academy), Guizhou University, Guiyang, 550025, People\u2019s Republic of China"],"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Guizhou University, Guiyang, 550025, People\u2019s Republic of China","institution_ids":["https://openalex.org/I178232147"]},{"raw_affiliation_string":"State Key Laboratory of Public Big Data (Guizhou Big Data Academy), Guizhou University, Guiyang, 550025, People\u2019s Republic of China","institution_ids":["https://openalex.org/I178232147","https://openalex.org/I4210160692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076621366","display_name":"Guojun Peng","orcid":"https://orcid.org/0000-0001-5731-8958"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guojun Peng","raw_affiliation_strings":["School of Cyber Science and Engineering, Wuhan University, Wuhan, 430072, People\u2019s Republic of China"],"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Wuhan University, Wuhan, 430072, People\u2019s Republic of China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108894815","display_name":"Di Yao","orcid":"https://orcid.org/0000-0002-5629-5464"},"institutions":[{"id":"https://openalex.org/I178232147","display_name":"Guizhou University","ror":"https://ror.org/02wmsc916","country_code":"CN","type":"education","lineage":["https://openalex.org/I178232147"]},{"id":"https://openalex.org/I4210160692","display_name":"Guizhou Academy of Sciences","ror":"https://ror.org/05ty2n298","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210160692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Di Yao","raw_affiliation_strings":["State Key Laboratory of Public Big Data (Guizhou Big Data Academy), Guizhou University, Guiyang, 550025, People\u2019s Republic of China"],"affiliations":[{"raw_affiliation_string":"State Key Laboratory of Public Big Data (Guizhou Big Data Academy), Guizhou University, Guiyang, 550025, People\u2019s Republic of China","institution_ids":["https://openalex.org/I178232147","https://openalex.org/I4210160692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101627369","display_name":"Chaofan Chen","orcid":"https://orcid.org/0000-0002-9250-5887"},"institutions":[{"id":"https://openalex.org/I178232147","display_name":"Guizhou University","ror":"https://ror.org/02wmsc916","country_code":"CN","type":"education","lineage":["https://openalex.org/I178232147"]},{"id":"https://openalex.org/I4210160692","display_name":"Guizhou Academy of Sciences","ror":"https://ror.org/05ty2n298","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210160692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chaofan Chen","raw_affiliation_strings":["State Key Laboratory of Public Big Data (Guizhou Big Data Academy), Guizhou University, Guiyang, 550025, People\u2019s Republic of China"],"affiliations":[{"raw_affiliation_string":"State Key Laboratory of Public Big Data (Guizhou Big Data Academy), Guizhou University, Guiyang, 550025, People\u2019s Republic of China","institution_ids":["https://openalex.org/I178232147","https://openalex.org/I4210160692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103351032","display_name":"Cheng Wang","orcid":"https://orcid.org/0009-0008-7751-6167"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chenyang Wang","raw_affiliation_strings":["School of Cyber Science and Engineering, Wuhan University, Wuhan, 430072, People\u2019s Republic of China"],"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Wuhan University, Wuhan, 430072, People\u2019s Republic of China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017640006","display_name":"Dongni Zhang","orcid":"https://orcid.org/0000-0001-9788-3249"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dongni Zhang","raw_affiliation_strings":["School of Cyber Science and Engineering, Wuhan University, Wuhan, 430072, People\u2019s Republic of China"],"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Wuhan University, Wuhan, 430072, People\u2019s Republic of China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089845104","display_name":"Yu Zhou","orcid":"https://orcid.org/0000-0002-8912-1719"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yilin Zhou","raw_affiliation_strings":["School of Cyber Science and Engineering, Wuhan University, Wuhan, 430072, People\u2019s Republic of China"],"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Wuhan University, Wuhan, 430072, People\u2019s Republic of China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5123209643","display_name":"Zixuan Yang","orcid":null},"institutions":[{"id":"https://openalex.org/I178232147","display_name":"Guizhou University","ror":"https://ror.org/02wmsc916","country_code":"CN","type":"education","lineage":["https://openalex.org/I178232147"]},{"id":"https://openalex.org/I4210160692","display_name":"Guizhou Academy of Sciences","ror":"https://ror.org/05ty2n298","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210160692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zixuan Yang","raw_affiliation_strings":["State Key Laboratory of Public Big Data (Guizhou Big Data Academy), Guizhou University, Guiyang, 550025, People\u2019s Republic of China"],"affiliations":[{"raw_affiliation_string":"State Key Laboratory of Public Big Data (Guizhou Big Data Academy), Guizhou University, Guiyang, 550025, People\u2019s Republic of China","institution_ids":["https://openalex.org/I178232147","https://openalex.org/I4210160692"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":10,"corresponding_author_ids":["https://openalex.org/A5100722817"],"corresponding_institution_ids":["https://openalex.org/I178232147","https://openalex.org/I4210160692"],"apc_list":null,"apc_paid":null,"fwci":104.265,"has_fulltext":true,"cited_by_count":3,"citation_normalized_percentile":{"value":0.99898013,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"9","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.8011000156402588,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.8011000156402588,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.021199999377131462,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14347","display_name":"Big Data and Digital Economy","score":0.012900000438094139,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.531000018119812},{"id":"https://openalex.org/keywords/knowledge-graph","display_name":"Knowledge graph","score":0.513700008392334},{"id":"https://openalex.org/keywords/knowledge-base","display_name":"Knowledge base","score":0.4959000051021576},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.46540001034736633},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.4487999975681305},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.42879998683929443},{"id":"https://openalex.org/keywords/inference-engine","display_name":"Inference engine","score":0.3919999897480011},{"id":"https://openalex.org/keywords/knowledge-representation-and-reasoning","display_name":"Knowledge representation and reasoning","score":0.39100000262260437},{"id":"https://openalex.org/keywords/situation-awareness","display_name":"Situation awareness","score":0.37049999833106995}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7871000170707703},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.531000018119812},{"id":"https://openalex.org/C2987255567","wikidata":"https://www.wikidata.org/wiki/Q33002955","display_name":"Knowledge graph","level":2,"score":0.513700008392334},{"id":"https://openalex.org/C4554734","wikidata":"https://www.wikidata.org/wiki/Q593744","display_name":"Knowledge base","level":2,"score":0.4959000051021576},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.46540001034736633},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.4487999975681305},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.42879998683929443},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.41530001163482666},{"id":"https://openalex.org/C46743427","wikidata":"https://www.wikidata.org/wiki/Q1341685","display_name":"Inference engine","level":3,"score":0.3919999897480011},{"id":"https://openalex.org/C161301231","wikidata":"https://www.wikidata.org/wiki/Q3478658","display_name":"Knowledge representation and reasoning","level":2,"score":0.39100000262260437},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.37049999833106995},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3637000024318695},{"id":"https://openalex.org/C115925183","wikidata":"https://www.wikidata.org/wiki/Q1412694","display_name":"Knowledge-based systems","level":2,"score":0.32989999651908875},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.32409998774528503},{"id":"https://openalex.org/C120567893","wikidata":"https://www.wikidata.org/wiki/Q1582085","display_name":"Knowledge extraction","level":2,"score":0.32350000739097595},{"id":"https://openalex.org/C2777220311","wikidata":"https://www.wikidata.org/wiki/Q6423340","display_name":"Knowledge acquisition","level":2,"score":0.3188000023365021},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.31839999556541443},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.3165000081062317},{"id":"https://openalex.org/C6881194","wikidata":"https://www.wikidata.org/wiki/Q7449091","display_name":"Semantic technology","level":4,"score":0.30250000953674316},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.30230000615119934},{"id":"https://openalex.org/C2767350","wikidata":"https://www.wikidata.org/wiki/Q6662173","display_name":"Business intelligence","level":2,"score":0.29989999532699585},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.2904999852180481},{"id":"https://openalex.org/C85407183","wikidata":"https://www.wikidata.org/wiki/Q1045785","display_name":"Semantic network","level":2,"score":0.2827000021934509},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.275299996137619},{"id":"https://openalex.org/C166423231","wikidata":"https://www.wikidata.org/wiki/Q1891170","display_name":"Semantic search","level":3,"score":0.273499995470047},{"id":"https://openalex.org/C136886441","wikidata":"https://www.wikidata.org/wiki/Q926129","display_name":"Normalization (sociology)","level":2,"score":0.2734000086784363},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.26910001039505005},{"id":"https://openalex.org/C234837","wikidata":"https://www.wikidata.org/wiki/Q1420493","display_name":"Conceptual graph","level":3,"score":0.2687000036239624},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2597000002861023},{"id":"https://openalex.org/C84685590","wikidata":"https://www.wikidata.org/wiki/Q1540472","display_name":"Knowledge engineering","level":2,"score":0.2556999921798706},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.2524999976158142},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.251800000667572}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-025-00505-y","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00505-y","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00505-y.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:f6c90cc43a824e0e88abc347589f9a33","is_oa":true,"landing_page_url":"https://doaj.org/article/f6c90cc43a824e0e88abc347589f9a33","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 9, Iss 1, Pp 1-29 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-025-00505-y","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00505-y","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00505-y.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1121271761","display_name":null,"funder_award_id":"Program","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G1231421488","display_name":null,"funder_award_id":"under","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G1845341635","display_name":"Renovation and Expansion of Research Facilities in the Chemistry  Department;","funder_award_id":"6220211","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G2087396116","display_name":null,"funder_award_id":"China","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2901559538","display_name":null,"funder_award_id":"62172308","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3317480652","display_name":null,"funder_award_id":"Science","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G37568934","display_name":null,"funder_award_id":"Grant","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4020255992","display_name":null,"funder_award_id":"Project","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4840164131","display_name":null,"funder_award_id":"72261004","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5939423041","display_name":null,"funder_award_id":"Technology","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5994120800","display_name":null,"funder_award_id":"Natural","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6338816908","display_name":"The Theory of Elementary Particles","funder_award_id":"6217230","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6526812876","display_name":null,"funder_award_id":"62202118","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7033253288","display_name":null,"funder_award_id":"Grants","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G73526442","display_name":null,"funder_award_id":"20211","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G7369497905","display_name":null,"funder_award_id":"PA[2025]004","funder_id":"https://openalex.org/F4320327826","funder_display_name":"Jilin Province Key R&D Plan Project"},{"id":"https://openalex.org/G7608752429","display_name":null,"funder_award_id":"Talent","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G848032724","display_name":null,"funder_award_id":"Science","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8955107213","display_name":null,"funder_award_id":"Major","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320321927","display_name":"Guizhou University","ror":"https://ror.org/02wmsc916"},{"id":"https://openalex.org/F4320327826","display_name":"Jilin Province Key R&D Plan Project","ror":null},{"id":"https://openalex.org/F4320329858","display_name":"Major Scientific and Technological Special Project of Guizhou Province","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7124423884.pdf","grobid_xml":"https://content.openalex.org/works/W7124423884.grobid-xml"},"referenced_works_count":53,"referenced_works":["https://openalex.org/W2604165577","https://openalex.org/W2771963642","https://openalex.org/W2978956219","https://openalex.org/W3010336026","https://openalex.org/W3111875330","https://openalex.org/W3161557830","https://openalex.org/W3176367300","https://openalex.org/W3180238884","https://openalex.org/W3199453968","https://openalex.org/W3211888892","https://openalex.org/W3214329506","https://openalex.org/W4226346873","https://openalex.org/W4281478262","https://openalex.org/W4286375281","https://openalex.org/W4309674289","https://openalex.org/W4319079731","https://openalex.org/W4381137026","https://openalex.org/W4387298166","https://openalex.org/W4387369249","https://openalex.org/W4388562958","https://openalex.org/W4389523710","https://openalex.org/W4391093150","https://openalex.org/W4391136507","https://openalex.org/W4392126412","https://openalex.org/W4394852354","https://openalex.org/W4395080429","https://openalex.org/W4400612817","https://openalex.org/W4401004521","https://openalex.org/W4402158164","https://openalex.org/W4402644087","https://openalex.org/W4402671741","https://openalex.org/W4404555905","https://openalex.org/W4404724679","https://openalex.org/W4404731747","https://openalex.org/W4404781333","https://openalex.org/W4404781674","https://openalex.org/W4404801827","https://openalex.org/W4406858760","https://openalex.org/W4407361734","https://openalex.org/W4407783824","https://openalex.org/W4408165425","https://openalex.org/W4408354083","https://openalex.org/W4408566170","https://openalex.org/W4408932676","https://openalex.org/W4409061246","https://openalex.org/W4409129276","https://openalex.org/W4409361511","https://openalex.org/W4409656997","https://openalex.org/W4410344873","https://openalex.org/W4411457420","https://openalex.org/W4412439815","https://openalex.org/W4415797703","https://openalex.org/W6941230632"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"With":[1],"the":[2,59,119,177],"increasing":[3],"frequency":[4],"of":[5,63],"APT":[6],"attacks,":[7],"cyber":[8,244],"defense":[9],"urgently":[10],"demands":[11],"high-quality":[12,164],"threat":[13,17,28,128,141,205,245],"intelligence":[14,18],"support.":[15],"Cyber":[16],"(CTI)":[19],"knowledge":[20,124,159,166,179,214],"graphs":[21],"have":[22],"demonstrated":[23],"significant":[24],"potential":[25],"in":[26,81,93,231],"aiding":[27],"detection":[29],"and":[30,49,61,70,88,96,127,135,143,158,181,194,207,209,222,234,239,247],"behavioral":[31],"reasoning.":[32,129,225],"However,":[33],"existing":[34],"CTI":[35,123,165,213],"data":[36],"often":[37],"suffer":[38],"from":[39],"unstructured":[40],"formats,":[41],"fragmented":[42],"knowledge,":[43],"a":[44,107,163,169,186,211,237],"reliance":[45],"on":[46],"manual":[47],"annotation,":[48],"limited":[50],"semantic":[51,116],"mapping":[52],"to":[53,79,98,118,138,151],"attack":[54,68,220],"techniques.":[55],"These":[56],"limitations":[57],"hinder":[58],"robustness":[60],"accuracy":[62],"downstream":[64],"reasoning":[65,171],"tasks":[66],"(e.g.,":[67],"attribution":[69],"intent":[71,221],"inference).":[72],"Moreover,":[73],"traditional":[74],"information":[75],"extraction":[76],"methods":[77,230],"struggle":[78],"generalize":[80],"scenarios":[82],"involving":[83],"cross-paragraph":[84],"dependencies,":[85],"emerging":[86],"threats,":[87],"low-resource":[89],"samples,":[90],"exhibiting":[91],"weaknesses":[92],"context":[94],"awareness":[95],"sensitivity":[97],"prompt":[99],"variations.":[100],"To":[101],"this":[102],"end,":[103],"we":[104],"propose":[105],"CTI-Thinker,":[106],"novel":[108],"system":[109,227],"that":[110,201],"integrates":[111],"large":[112],"language":[113],"models":[114],"with":[115],"alignment":[117,149],"ATT&CK":[120,183],"framework":[121],"for":[122,161,243],"graph":[125,180],"construction":[126],"First,":[130],"CTI-Thinker":[131,202],"leverages":[132],"in-context":[133],"learning":[134],"LoRA-based":[136],"fine-tuning":[137],"extract":[139],"structured":[140,178],"entities":[142,206],"relations.":[144],"Then,":[145],"it":[146],"adopts":[147],"vector-based":[148],"strategies":[150],"unify":[152],"heterogeneous":[153],"expressions,":[154],"enabling":[155,191],"entity":[156],"normalization":[157],"fusion":[160],"constructing":[162],"graph.":[167,215],"Finally,":[168],"GraphRAG-based":[170],"engine":[172],"is":[173],"built":[174],"by":[175],"incorporating":[176],"external":[182],"resources":[184],"into":[185],"retrieval-augmented":[187],"generation":[188],"(RAG)":[189],"framework,":[190],"tactical-level":[192],"inference":[193],"CTI-driven":[195],"question":[196],"answering.":[197],"Experimental":[198],"results":[199],"demonstrate":[200],"accurately":[203],"extracts":[204],"relations":[208],"constructs":[210],"reliable":[212],"It":[216],"also":[217],"effectively":[218],"infers":[219],"supports":[223],"intelligent":[224],"The":[226],"outperforms":[228],"state-of-the-art":[229],"precision,":[232],"robustness,":[233],"generalizability,":[235],"offering":[236],"scalable":[238],"semantically":[240],"enriched":[241],"solution":[242],"analysis":[246],"defense.":[248],"Graphical":[249],"abstract":[250]},"counts_by_year":[{"year":2026,"cited_by_count":3}],"updated_date":"2026-04-18T07:56:08.524223","created_date":"2026-01-17T00:00:00"}