{"id":"https://openalex.org/W7172010563","doi":"https://doi.org/10.48550/arxiv.2607.27528","title":"ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping","display_name":"ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping","publication_year":2026,"publication_date":"2026-07-29","ids":{"openalex":"https://openalex.org/W7172010563","doi":"https://doi.org/10.48550/arxiv.2607.27528"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.27528","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.27528","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.27528","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133021813","display_name":"Cristian Leo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Leo, Cristian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5144167377","display_name":"Anton Dykyi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dykyi, Anton","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5144108648","display_name":"Danny Cortegaca","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cortegaca, Danny","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133058736","display_name":"Daniel Begimher","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Begimher, Daniel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5144131156","display_name":"Prakash Jha","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jha, Prakash","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5679000020027161,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5679000020027161,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.1379999965429306,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.06610000133514404,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/benchmarking","display_name":"Benchmarking","score":0.5228000283241272},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5105999708175659},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.5047000050544739},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.4959999918937683},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.46950000524520874},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.44830000400543213},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4426000118255615},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.43220001459121704},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.41589999198913574}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.697700023651123},{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.5228000283241272},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5105999708175659},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.5047000050544739},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.4959999918937683},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.46950000524520874},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.44830000400543213},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4426000118255615},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.43220001459121704},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.43160000443458557},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.41589999198913574},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3930000066757202},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3833000063896179},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.3587999939918518},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3409999907016754},{"id":"https://openalex.org/C2778485113","wikidata":"https://www.wikidata.org/wiki/Q193231","display_name":"Debugger","level":3,"score":0.30869999527931213},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.2994999885559082},{"id":"https://openalex.org/C34388435","wikidata":"https://www.wikidata.org/wiki/Q2267362","display_name":"Bounded function","level":2,"score":0.2971999943256378},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.29589998722076416},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.29260000586509705},{"id":"https://openalex.org/C2777168461","wikidata":"https://www.wikidata.org/wiki/Q42196253","display_name":"Set operations","level":3,"score":0.29159998893737793},{"id":"https://openalex.org/C113174947","wikidata":"https://www.wikidata.org/wiki/Q2859736","display_name":"Tree (set theory)","level":2,"score":0.2856000065803528},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.2847999930381775},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.2791999876499176},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.2676999866962433},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.2667999863624573},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.25780001282691956},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.25609999895095825}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.27528","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.27528","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.27528","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.27528","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Threat":[0],"modeling":[1,66],"is":[2,14,132,228],"essential":[3],"for":[4,172,182,252],"secure":[5],"software":[6],"development,":[7],"yet":[8],"manual":[9],"analysis":[10],"of":[11,50,152],"cloud-native":[12],"architectures":[13],"slow":[15],"and":[16,43,55,59,85,88,103,161,177],"demands":[17],"scarce":[18],"security":[19],"expertise.":[20],"We":[21,137],"present":[22],"ThreatForest,":[23],"a":[24,47,68,94,145,150,169,187,235,249],"multi-agent":[25,222],"system":[26,232],"that":[27,124,194,233],"generates":[28],"structured":[29],"attack":[30,37,113,175,240],"trees":[31,241],"from":[32,46],"source":[33],"code":[34,236],"repositories,":[35],"maps":[36,111],"steps":[38],"to":[39,115],"adversary":[40,246],"tactics,":[41],"techniques,":[42],"procedures":[44],"(TTPs)":[45],"pluggable":[48],"set":[49],"frameworks":[51],"(MITRE":[52],"ATT&CK,":[53],"CAPEC,":[54],"cloud-specific":[56],"threat":[57,65,77,173],"matrices),":[58],"synthesizes":[60],"actionable":[61],"mitigations.":[62],"ThreatForest":[63,139,227],"decomposes":[64],"into":[67,238],"multi-stage":[69],"agent":[70],"pipeline":[71],"--":[72,91,186],"repository":[73,237],"analysis,":[74],"context":[75],"refinement,":[76],"generation,":[78],"parallel":[79],"attack-tree":[80],"construction":[81],"with":[82,97,156,242,248],"TTP":[83,184],"mapping":[84,185,210],"mitigation":[86],"synthesis,":[87],"report":[89],"generation":[90],"orchestrated":[92],"as":[93],"directed":[95],"graph":[96],"deterministic":[98],"verification":[99,159],"gates,":[100],"bounded":[101],"retries,":[102],"three":[104],"human-in-the-loop":[105],"validation":[106],"points.":[107],"A":[108,199],"domain-specific":[109],"sentence-transformer":[110],"each":[112],"step":[114],"candidate":[116],"techniques":[117],"by":[118,149],"cosine":[119],"similarity;":[120],"we":[121],"show":[122],"empirically":[123],"this":[125],"embedding":[126,217],"stage,":[127],"not":[128],"the":[129,133,196,204,213,216,221,229],"surrounding":[130],"pipeline,":[131],"dominant":[134],"accuracy":[135],"bottleneck.":[136],"evaluate":[138],"across":[140,190,245],"seven":[141,192],"application":[142],"domains":[143,193],"on":[144,203,215],"sixteen-dimension":[146],"rubric,":[147],"scored":[148],"panel":[151],"independent":[153],"LLM":[154],"raters":[155],"an":[157],"adversarial":[158],"pass":[160],"expert":[162],"review.":[163],"Panel-measured":[164],"quality":[165],"reaches":[166],"0.63-0.68":[167],"(on":[168],"0-1":[170],"scale)":[171],"statements,":[174],"trees,":[176],"mitigations,":[178],"but":[179],"only":[180],"0.29":[181],"embedding-only":[183],"gap":[188],"stable":[189],"all":[191],"isolates":[195],"binding":[197],"constraint.":[198],"controlled":[200],"single-call":[201],"baseline":[202],"same":[205],"model":[206],"more":[207],"than":[208,220],"doubles":[209],"defensibility,":[211],"pinning":[212],"limitation":[214],"encoder":[218],"rather":[219],"design.":[223],"To":[224],"our":[225],"knowledge,":[226],"first":[230],"end-to-end":[231],"turns":[234],"TTP-mapped":[239],"evidence-based":[243],"mitigations":[244],"frameworks,":[247],"reusable":[250],"framework":[251],"benchmarking":[253],"such":[254],"systems.":[255]},"counts_by_year":[],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2026-08-01T00:00:00"}