RAG-based Cyber Threat Tracing Graph Modeling Method

Cyber-attacks have become increasingly complex and sophisticated, occurring frequently through various paths. Numerous attack techniques, such as ransomware, advanced persistent threat (APT) attacks, and viruses facilitated by generative artificial intelligence (GAI), are threatening systems. Attackers often remain hidden for extended periods, using networks to infiltrate and spread within internal systems, aiming to steal sensitive information. These stealthy lateral movements are difficult to detect and defend against, necessitating a graph-based approach to effectively track and analyze threats. In this paper, we propose a retrieval-augmented generation (RAG) based threat behavior tracing method that derives more meaningful results through the information retrieval functions in the large language model (LLM). We present a suitable graph model for threat tracing by comparing label property graph (LPG) and resource description framework (RDF) as graph methods for knowledge extraction in RAG.