为智能体设计的威胁情报数据结构，提升自动调查效率。
CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence
- 构建基于权威知识库的结构化威胁情报图谱，支持精准导航与推理。
- 在公开基准上，智能体性能提升0.19至0.28，小模型超越大模型。
- 适合开发自动化安全分析系统或研究智能体协作的开发者。
网络威胁情报（CTI）正从人工分析转向由大语言模型智能体在查询时执行多步调查。尽管智能体端的技术（如规划循环、工具协议、上下文管理）已成熟，但数据底座仍停滞不前：威胁报告和漏洞数据库仍以检索增强生成模式封装，作为嵌入索引后的模糊块。我们指出，真正瓶颈在于数据结构而非模型能力，提出CTIFoundry——一种面向智能体的威胁情报语料框架。构建阶段，该框架显式化了四大数据源（CVE、CWE、CAPEC、ATT&CK）间的隐含结构：通过官方交叉引用建立有类型、可遍历的本体图；基于实体跨度的报告层，对齐跨厂商实体并携带溯源信息；结合稠密与词法混合检索。查询阶段，该结构通过七个有类型工具与三个程序性技能暴露于开源智能体框架。在公开的CTIConnect基准测试中，仅更换动作接口即令相同智能体在四模型、两提供商组合下整体F1提升0.19至0.28；小模型在本结构上超越旗舰模型，且准确率提升未依赖更多工具调用——在Claude模型上，使用结构化数据的智能体以约一半调用次数实现更高精度。消融实验表明：有类型结构贡献最大，程序技能将结构转化为纪律性行动，二者叠加效果超线性，因技能仅作用于存在的结构。
原文摘要 · Abstract (English)
Cyber threat intelligence (CTI) is increasingly consumed not by human analysts but by LLM agents that compose multi-step investigations at query time. The harness side of this shift has matured rapidly (planning loops, tool protocols, context management), but the corpus side has not: threat reports and vulnerability databases are still packaged for retrieval-augmented generation, as opaque chunks behind an embedding index. We argue that this substrate, not model capability, is the bottleneck on agentic CTI investigation, and present CTIFoundry, an agent-native corpus scaffold. At build time, CTIFoundry materializes the latent structure of a CTI corpus: a deterministic ontology graph over four authoritative knowledge bases (CVE, CWE, CAPEC, ATT&CK) whose official cross-references become typed, traversable edges; a span-grounded report layer whose canonical, alias-resolved cross-vendor entities index provenance-carrying chunks; and hybrid dense+lexical retrieval surfaces. At query time this structure is exposed through seven typed tools and three procedural skills mounted on a stock open-source agent harness. On the public CTIConnect benchmark, swapping only the action surface lifts the identically-harnessed agent by +0.19 to +0.28 overall F1 across a four-model, two-provider panel: a small model on CTIFoundry surpasses a flagship on the flat substrate, and the gain is not bought with search effort, since on both Claude models the scaffolded agent is more accurate at roughly half the tool calls. An ablation attributes it: typed structure carries the larger share, procedural skills convert structure into discipline, and the two compose super-additively, because skills bind only to structure that exists.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。