{"id":"https://openalex.org/W7165647648","doi":"https://doi.org/10.48550/arxiv.2606.21059","title":"DEFENGRAPH: Knowledge Graph-Enhanced LLMs for Blue Team Cyber Defense","display_name":"DEFENGRAPH: Knowledge Graph-Enhanced LLMs for Blue Team Cyber Defense","publication_year":2026,"publication_date":"2026-06-19","ids":{"openalex":"https://openalex.org/W7165647648","doi":"https://doi.org/10.48550/arxiv.2606.21059"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.21059","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.21059","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.21059","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139162920","display_name":"Zhen Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Zhen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139182001","display_name":"Kristen Moore","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Moore, Kristen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139155232","display_name":"Qin Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Qin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139171974","display_name":"Guangsheng Yu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yu, Guangsheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048500989","display_name":"Minjune Kim","orcid":"https://orcid.org/0000-0002-6161-7982"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kim, Minjune","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084412291","display_name":"Diksha Goel","orcid":"https://orcid.org/0000-0001-8212-8793"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Goel, Diksha","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139210770","display_name":"Gang Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Gang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060682816","display_name":"Adam Ibrahim","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ibrahim, Ahmed","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5003096709","display_name":"Ahmad Mohsin","orcid":"https://orcid.org/0000-0001-9023-0851"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mohsin, Ahmad","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5035745103","display_name":"Helge Janicke","orcid":"https://orcid.org/0000-0002-1345-2829"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Janicke, Helge","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.5277000069618225,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.5277000069618225,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.05310000106692314,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.04740000143647194,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/workflow","display_name":"Workflow","score":0.5655999779701233},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.42750000953674316},{"id":"https://openalex.org/keywords/reliability","display_name":"Reliability (semiconductor)","score":0.4244000017642975},{"id":"https://openalex.org/keywords/subject-matter-expert","display_name":"Subject-matter expert","score":0.4032999873161316},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.39969998598098755},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.3824999928474426},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.37279999256134033},{"id":"https://openalex.org/keywords/domain-knowledge","display_name":"Domain knowledge","score":0.3540000021457672}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6506999731063843},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5781000256538391},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.5655999779701233},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.42750000953674316},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.4244000017642975},{"id":"https://openalex.org/C105002631","wikidata":"https://www.wikidata.org/wiki/Q4833645","display_name":"Subject-matter expert","level":3,"score":0.4032999873161316},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.39969998598098755},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.3824999928474426},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.37279999256134033},{"id":"https://openalex.org/C207685749","wikidata":"https://www.wikidata.org/wiki/Q2088941","display_name":"Domain knowledge","level":2,"score":0.3540000021457672},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3443000018596649},{"id":"https://openalex.org/C3018725008","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber threats","level":2,"score":0.32910001277923584},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32899999618530273},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3246000111103058},{"id":"https://openalex.org/C115086926","wikidata":"https://www.wikidata.org/wiki/Q17004651","display_name":"Causal reasoning","level":3,"score":0.3239000141620636},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.30149999260902405},{"id":"https://openalex.org/C179768478","wikidata":"https://www.wikidata.org/wiki/Q1120057","display_name":"Cyber-physical system","level":2,"score":0.3010999858379364},{"id":"https://openalex.org/C2779033394","wikidata":"https://www.wikidata.org/wiki/Q5186733","display_name":"Critical infrastructure protection","level":3,"score":0.2985999882221222},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2978000044822693},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.29319998621940613},{"id":"https://openalex.org/C2778024590","wikidata":"https://www.wikidata.org/wiki/Q2357432","display_name":"Cheating","level":2,"score":0.28679999709129333},{"id":"https://openalex.org/C2776987312","wikidata":"https://www.wikidata.org/wiki/Q19693316","display_name":"First responder","level":2,"score":0.2732999920845032},{"id":"https://openalex.org/C22607594","wikidata":"https://www.wikidata.org/wiki/Q5375150","display_name":"Enabling","level":2,"score":0.26989999413490295},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.2694999873638153},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.26089999079704285},{"id":"https://openalex.org/C115925183","wikidata":"https://www.wikidata.org/wiki/Q1412694","display_name":"Knowledge-based systems","level":2,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.21059","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.21059","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.21059","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.21059","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models":[2],"(LLMs)":[3],"show":[4,153],"promise":[5],"for":[6,207],"supporting":[7],"decision-making":[8],"in":[9,14,29,73,92],"cybersecurity,":[10],"but":[11],"their":[12],"reliability":[13],"high-stakes,":[15],"time-evolving":[16],"environments":[17],"remains":[18],"limited":[19],"due":[20],"to":[21,39,167,174,178,186,190,195,200],"hallucinations,":[22],"poor":[23],"temporal":[24],"reasoning,":[25],"and":[26,65,78,84,112,138,145,169,192,212],"shallow":[27],"grounding":[28],"system":[30,108,146],"context.":[31],"We":[32,89],"introduce":[33],"DEFENGRAPH,":[34],"an":[35],"LLM-driven":[36,62],"assistant":[37],"designed":[38],"support":[40],"human":[41],"defenders":[42],"during":[43,121],"cybersecurity":[44],"incidents.":[45],"DEFENGRAPH":[46,91,155],"improves":[47],"contextual":[48,63],"reasoning":[49],"by":[50],"integrating":[51],"a":[52,93,157],"dual-layer":[53],"Static-Dynamic":[54],"Knowledge":[55],"Graph":[56],"(KG)":[57],"with":[58,180],"graph-based":[59],"path":[60],"retrieval,":[61],"filtering,":[64],"reasoning-based":[66],"re-ranking.":[67],"The":[68,116],"framework":[69],"grounds":[70],"LLM":[71],"outputs":[72],"both":[74],"long-term":[75],"domain":[76],"knowledge":[77,98],"evolving":[79],"event":[80],"context,":[81],"enabling":[82],"faithful":[83],"temporally":[85],"aware":[86],"decision":[87],"support.":[88],"evaluate":[90],"cyber":[94,127],"defense":[95,203],"setting":[96],"using":[97],"graphs":[99],"constructed":[100],"from":[101,165,172],"heterogeneous":[102],"security":[103],"artifacts,":[104],"including":[105],"SIEM":[106],"alerts,":[107],"topology,":[109],"attacker":[110],"behaviors,":[111],"prior":[113],"defensive":[114],"actions.":[115],"evaluation":[117],"uses":[118],"data":[119],"collected":[120],"live":[122],"Red":[123],"vs.":[124],"Blue":[125],"team":[126],"range":[128],"exercises":[129],"simulating":[130],"attacks":[131],"on":[132,160,183],"critical":[133],"infrastructure,":[134],"which":[135],"generate":[136],"realistic":[137],"noisy":[139],"datasets":[140],"reflecting":[141],"real-world":[142],"defender":[143],"workflows":[144],"dynamics.":[147],"Evaluations":[148],"across":[149],"four":[150],"prevalent":[151],"LLMs":[152],"that":[154],"sets":[156],"new":[158],"state-of-the-art:":[159],"GPT-4o":[161],"it":[162],"boosts":[163],"reasoning-recall":[164],"61.45\\%":[166],"73.49\\%":[168],"ticket-action":[170],"recall":[171],"52.17%":[173],"72.46%":[175],"(precision":[176],"24.49\\%":[177],"29.24\\%),":[179],"similar":[181],"gains":[182],"LLaMA-3":[184],"(46.99\\%":[185],"61.45\\%),":[187],"DeepSeek-R1":[188],"(45.78\\%":[189],"56.63\\%)":[191],"QWen-3":[193],"(51.81\\%":[194],"59.04\\%),":[196],"while":[197],"surfacing":[198],"up":[199],"50":[201],"correct":[202],"actions":[204],"versus":[205],"36":[206],"the":[208],"next":[209],"best":[210],"baseline":[211],"holding":[213],"fault":[214],"rates":[215],"steady.":[216]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-24T00:00:00"}