GRID: New Framework for Security Knowledge Graph Construction from CTI
A new framework named GRID (Graph Representation of Intelligence Data) has been developed by researchers to create knowledge graphs from cyber threat intelligence (CTI) texts. This innovative system tackles the difficulties of grounding large language models with expertise in security and overseeing the training from documents to graphs. Initially, GRID generates security-domain supervision from CTI articles by establishing traceable alignments between articles and graphs through graph extraction and knowledge-graph-conditioned text modification. It then converts document-to-graph learning into a structured task bank that integrates four-option multiple-choice questions with triple-level regex matching targets, resulting in more consistent task-specific rewards compared to evaluating complete graph outputs with an LLM judge. The Qwen3-4B-Instr models are trained using this methodology. The research paper can be found on arXiv with the identifier 2605.16714.
Key facts
- GRID is an end-to-end framework for security text knowledge graph construction.
- It creates traceable article-graph alignments from CTI articles.
- The framework uses a scripted task bank with multi-select questions and regex matching.
- It trains Qwen3-4B-Instr models.
- The paper is on arXiv with ID 2605.16714.
- GRID addresses LLM grounding and supervision challenges in CTI knowledge graph construction.
Entities
Institutions
- arXiv