This paper proposes GRAL, which is an AI-driven framework that combines graph neural networks (GNN) for cross-asset temporal alert correlation, retrieval-augmented generation (RAG) for dynamic threat intelligence enrichment, and large language models (LLM) for semantic reasoning and verdict generation.
Abstract
In critical infrastructure environments, cybersecurity situation-awareness platforms generate large volumes of alerts, including substantial numbers of false positives, placing a considerable burden on security analysts. At present, alert correlation methods mainly rely on rule-based matching or statistical clustering, and large language models often lack the domain-specific threat intelligence required for reliable security analysis. This paper proposes GRAL, which is an AI-driven framework that combines graph neural networks (GNN) for cross-asset temporal alert correlation, retrieval-augmented generation (RAG) for dynamic threat intelligence enrichment, and large language models (LLM) for semantic reasoning and verdict generation. A temporal heterogeneous graph attention network constructs alert-relation graphs within a 72 h sliding window, and temporal decay and multi-relational dependencies are captured. Powered by bge-m3 embeddings and a dense vector index, the RAG module retrieves the most relevant threat intelligence entries above a cosine similarity threshold of 0.75. A domain-specific dataset of 1000 annotated security alerts from a nuclear power operational environment was built, and Cohen’s Kappa reached 0.87. The experiments show that GRAL achieves a macro-averaged precision of 87.0%, a macro-averaged recall of 97.0%, and a binary false-positive rate of 9.1%, together with 92.5% alert compression. Generalisation capability is confirmed by cross-dataset evaluation on CICIDS2017 (93.0% accuracy and 92.5% F1-score) and UNSW-NB15 (89.4% accuracy and 89.8% F1-score).
Cyber Threat Intelligence (CTI) enables Security Operations Centers (SOCs) to understand adversary behavior,
prioritize risks, and respond to cyber threats. However, cur-rent CTI workflows still depend heavily on manual analysis
of unstructured threat reports, vulnerability advisories, open-source intelligence, social media posts, and structured feeds. This
creates operational latency, inconsistent extraction quality, weak provenance, and limited scalability. This paper presents Auto
Threat AI, an agentic and explainable framework for automated CTI extraction, correlation, scoring, and analyst-governed SOC
operationalization. The proposed framework integrates determin-istic indicator extraction, Natural Language Processing (NLP),
schema-guided Large Language Model (LLM) agents, graph-aware threat correlation, bounded risk scoring, evidence-first
explainability, and Human-in-the-Loop (HITL) governance. The system ingests heterogeneous CTI sources, extracts entities and
relations such as IOCs, CVEs, malware, campaigns, threat actors, tools, and techniques, constructs a threat knowledge graph,
gen-erates campaign candidates, and presents risk-ranked intelligence through a SOC dashboard. Experimental evaluation on
safe demonstration CTI data shows that the implemented prototype ingested 6 sources, extracted 36 entities, generated 33
relations, detected 11 threat events, identified 5 campaign candidates, and routed 8 items for HITL review. The results
demonstrate that Auto Threat AI can reduce manual CTI processing effort while improving traceability, explainability, and
analyst trust.
Methari Keeravani· International Journal for Re...· 0 citations
The rapid advancement of digital communication and networking technologies has resulted in a significant increase in the frequency and sophistication of cyber threats, creating new challenges for securing modern computer networks. Traditional intrusion detection approaches mainly depend on signature-based techniques and predefined security rules, making them less effective against newly emerging and continuously evolving cyber attacks. To address these limitations, this study presents an Explainable Artificial Intelligence (XAI)-based cyber threat detection framework that combines Long Short-Term Memory (LSTM) and Autoencoder models for accurate and transparent threat detection. The LSTM model captures sequential network traffic patterns to identify temporal attack behaviours, whereas the Autoencoder detects anomalous activities by learning the characteristics of normal network traffic. The integration of Explainable AI enables users to understand prediction outcomes by highlighting the factors influencing each detection decision. Furthermore, the framework performs quantitative risk assessment, categorizes threats into multiple severity levels, and generates suitable mitigation recommendations through an interactive web-based dashboard. Experimental results demonstrate that the proposed framework provides reliable, interpretable, and effective cyber threat detection, thereby supporting security professionals in making timely and well-informed decisions.
Indu Asitha, Manjunatha B. N.· International Journal of Com...· 0 citations
Large-scale DDoS attacks remain a serious threat to today's networked systems, which aim to make services unavailable by sending a massive amount of traffic. The traditional detection methods are mostly about attack categorization and are not that context-aware or actionable in providing support to security analysts. We propose SentinelsGuard AI, a self-learning DDoS classification and mitigation system that is built from a combination of machine learning, retrieval-augmented knowledge, and LLM-based reasoning in one platform. The proposed system is realized as a Flask-based web application, which processes the network flow statistics data, extracted from incoming traffic, and transforms the data to generate representative features of the network flows, before detecting the attacks using the XGBoost classifier. After classification, the framework accesses domain-specific attack intelligence from a structured Retrieval-Augmented Generation (RAG) knowledge base with profiles of multiple categories of DDoS attacks. This contextual information is used with LLM-enabled reasoning to derive comprehensible security explanations, determine the severity of the attack, and suggest the firewall mitigation rules that can be applied. The framework stores analysis data in a SQLite database for operational monitoring, and displays security events in an interactive dashboard that includes traffic visualization, attack logs, and threat summaries. The architecture proposed brings statistical learning together with contextual knowledge of cybersecurity and attempts to bridge the gap between automatic attack detection and explainable incident response. It integrates all the key features of a classification-based network security decision support platform into a single stream, enabling a classification-based approach to network security to become more interpretable and usable in reality: persistent logging, visualization, knowledge retrieval, reasoning, and system recommendation of mitigations.
K. Phani, P. Karthik, PG Student et al.· 2026 International Conferenc...· 0 citations
Logistics Cyber-Physical Systems (LCPS) generate large volumes of regulatory and operational texts that encode early signals of safety risks. Converting short, noisy, and domain-specific records into actionable intelligence is difficult due to industrial semantic drift and the limited auditability of black-box predictors. This paper proposes Neuro-Symbolic Logistics Risk Awareness (NS-LRA), a dual-channel framework that integrates lightweight semantic perception with constraint-aware topological reasoning. NS-LRA first maps raw texts to a standardized schema of $K=20$ risk nodes using a dual-weighted embedding mechanism that combines TF-IDF and Word2Vec to mitigate short-text sparsity. It then constructs a directed risk graph by fusing co-occurrence evidence with a domain constraint mask, and derives hierarchical propagation via ISM level partitioning with deep-driver identification via MICMAC analysis. We evaluate NS-LRA on $N=8,435$ records, validated against an annotated subset $(\mathcal{D}_{\text{ann}}=1,500)$) with Fleiss' $\kappa=0.82$ and an expert-defined gold graph. NS-LRA achieves Micro-$\mathrm{F} \mathrm{1}=\text{0. 8 7 9}$ for risk mapping and approximately $22 \times$ lower perrecord CPU latency than fine-tuned BERT on the same test split under the same environment. For topological inference, NS-LRA reports $\text{E P}=\text{0. 9 2 4}$ and $\text{T C}=\text{0. 9 5}$ against the gold graph. These results indicate that NS-LRA can provide an efficient and traceable pipeline for proactive risk governance in LCPS.
Ke Huang, Yan Liu, Bin Guo et al.· Annual International Compute...· 0 citations
As the number of network attacks continues to increase, cybersecurity systems require intelligent and scalable solutions to detect more and more complex network attacks in real time. This paper suggests an end-to-end intelligent cybersecurity system for detecting intrusion with CICIDS2017 dataset with multiple classes. Proposed system performs complete data pre-processing that consists of missing value removal, duplication elimination, label encoding, feature normalisation and Principal Component Analysis based feature selection to enhance the data quality and learning efficiency. Some ML models such as DT, RF, ET, LR, Gaussian Naïve Bayes and a soft Voting Classifier are tested along with DL architectures like DNN, CNN, LSTM, CNN-LSTM, and CNN-LSTM-GRU. In addition, the works of Generative AI models, such as VAE, GAN, and Distil GPT2 are explored for anomaly modelling, generation of minority samples, and generation of text data for cybersecurity applications. XAI techniques (LIME and SHAP) reveal the main network traffic aspects to improve transparency of the forecast. The experimental results indicate that the Voting Classifier obtained the accuracy of 99.6% and the LSTM model obtained the accuracy of 99.3%. Both models can reliably detect various types of cyber attacks. Last, the framework is also deployed as a web application that uses Flask to enable real-time deployment of intrusion prediction and visualisation.
Kanemoni Omkar, Donempudi Shailaja, Dr. Jyothi Anantula et al.· 2026 6th International Confe...· 0 citations
STINER, a taxonomy and expert-annotated corpus for extracting strategic intelligence from social media streams is introduced, and how social-media-driven extraction can surface early signals of the SafePay ransomware campaign prior to its retrospective characterization in vendor threat landscape reports is illustrated.
Yasir Ech-Chammakhy, Oussama Azrara, J. Chbili et al.· 0 citations