A Multi-hop Reasoning Framework for Cyber Threat Intelligence Knowledge Graph

Cyber threat intelligence is important information for analysing cyber threats. Most of the research focuses on extracting threat entities from threat intelligence and constructing knowledge graphs, with less research on reasoning on the threat intelligence knowledge graph. Existing research has limited ability to reason about implicit information in the threat intelligence knowledge graph and is not interpretable. In addition, the amount of information contained in the threat intelligence knowledge graph has an inherent upper limit, and the existing multihop reasoning methods are also constrained by the limitation caused by the knowledge graph, which affects their performance. In this paper, we propose a multi-hop reasoning framework for the cyber threat intelligence knowledge graph, which uses a language model for multi-hop reasoning, views the reasoning process as a sequence-to-sequence task, and generates multihop reasoning paths based on reasoning queries. To alleviate the limitation of the threat intelligence knowledge graph, we inject external knowledge graphs into the language model and add a rule enhancement strategy, and the experimental results show some improvement in multi-hop reasoning performance and interpretability.