In cybersecurity, the threat landscape is composed of complex relations among security data and constantly evolves. To address this challenge, this paper presents a framework for constructing and reasoning over cybersecurity knowledge graphs (KGs) derived from vulnerability reports. Our approach analyzes textual content and structured data sources. To enhance causal reasoning, we explicitly model key causal factors as structured entities and relationships. The resulting KG is further enriched through augmentation using DBpedia, integrating external knowledge to enhance connectivity and context. We evaluate the impact of this augmentation through a comparison, contrasting the content of the original and the augmented graphs. Experimental results demonstrate that the Graph-LLM approach, with augmentation, enhances link prediction and produces higher-quality Question Answering (QA) compared to using report descriptions alone. We demonstrate a hybrid reasoning setup integrating LLM-based language understanding with graph inference to answer cybersecurity queries.
Cybersecurity is a specialized domain where analysts must interpret vast, evolving data to detect threats,
understand vulnerabilities, and respond appropriately [
To address the challenges outlined above, we propose a hybrid framework that combines strong language
understanding of LLMs with the semantic expressiveness of knowledge graphs for cybersecurity threat
understanding. To this end, the KG is first constructed by analyzing structured and unstructured
data to discover associations in vulnerability reports CPE [
CEUR
ceur-ws.org augmented Graph-LLM improves link prediction and Question Answering (QA) quality over report descriptions alone. Finally, we present a hybrid pipeline that integrates LLM outputs with KG inference to answer cybersecurity queries, thereby enhancing reasoning through knowledge graph retrieval.
The methodology depicted in Fig. 1 comprises several steps grouped into pipelines: 1) text mining extracts content from the text descriptions, 2) KG creation builds the KG combining structured data and content from the text mining, and 3) KG exploitation performs reasoning on the KG created. For LLM processing, we used LLaMA 3.3 70B instruct model [11].
1. Text mining. 2. The KG construction.
a) In pre-processing, vulnerability reports are retrieved, parsed, and cleaned. b) Rule patterns and the syntactic tree. This process is used to identify concepts and relationships. It is performed as a fallback option of LLM entity extraction. c) Co-reference resolution is computed to extract the reference for the same entity in the text. d) Entity extraction. This process is handled by the LLM, which identifies causal factors: entities, relationships, states, actors, objects, and properties. e) Acronym resolution is performed using specialized dictionaries and LLM knowledge. f) The KG construction organizes the data collected through text mining into a raw graph (i.e., a graph without Resource Description Framework (RDF) notation [12]). g) The KG reshaping converts the raw graph into an RDF graph [13], which is a foundational data model for representing knowledge as triples. The KG is based on a schema (ontology). h) The graph is augmented using concepts and relations from DBpedia. The LLM selects the most appropriate concept during expansion to create coherent graph excerpts.
i) The graph created is stored in a Virtuoso open-source triple store [14]. 3. KG exploitation.
j) In the KG retrieval step. SPARQL queries [15] retrieve content from the KG stored in the triple store based on the user request using multi-hop expansion. k) The graphs retrieved are encoded into text for the LLM’s processing.
l) The LLM hybrid reasoning combines graph data and the user query to perform reasoning. .
An example of knowledge graph creation and augmentation is presented. A graph excerpt derived from structured information and its augmentation is presented in Fig. 2. The main elements of the graph created are highlighted.
A response generated by LLM–graph reasoning is shown in Table 1. In this hybrid approach, the LLM analyzes the user query alongside the graph content retrieved based on terms from the question. The ifrst row presents the result of the LLM reasoning using only plain text (i.e., the report description). In contrast, the graph-LLM response includes versions connected to this report.
Additionally, the visualization of the KG exploitation is depicted in Fig.3. Once the query is entered, the user can select a specific vulnerability report (CWE, CVE, or CPE) to perform the reasoning. The user can define the number of hops to expand the query and choose whether the expansion includes conceptual relations or only directly related reports.
We measured new relation discovery after KG augmentation using link prediction with AmpliGraph [16]. On the CWE subgraph, TransE, ComplEx, and DistMult [13] were evaluated; ComplEx performed
Reasoning result Ground truth answer: In the Web GUI.
Graph-LLM answer: Based on the graph data, the issue is located in the Web GUI of Extreme Networks EXOS versions before v.22.7 and before v.30.2.
The problem stems from the failure of the Web GUI to restrict URL access, allowing attackers to access sensitive information or escalate privileges. best, and the KG with text mining content (no DBpedia) achieved the highest results (Table 2). The augmented KG showed low performance because the LLM struggled with KG excerpt selection; that is, it chose an incorrect meaning for the expanded concept on DBpedia, adding noise and negatively afecting link prediction. Using a diferent LLM that handles this task better might improve performance.
In addition, the quality of the responses was measured by Gemma 3 27B model [17] with a multi-hop expansion of 5 levels. LLM with ground truth refers to answers derived from the text descriptions in vulnerability reports. In contrast, Graph LLM responses are generated using hybrid reasoning. In the evaluation, Graph LLM produced showed the best performance (Table 3).
This poster presents a hybrid framework for cybersecurity threat reasoning that combines automatically constructed knowledge graphs with the reasoning capabilities of large language models (LLMs). The framework created graphs that represent causal factors and was enriched through DBpedia augmentation. To overcome LLM limitations in complex graph operations, we developed a dedicated subgraph extraction process. This module lets LLMs handle language comprehension and logical reasoning, while the graph module performs structured inference. Together, this hybrid pipeline provides a scalable and interpretable solution for addressing complex cybersecurity queries, with potential applications extending beyond this domain. As a practical application, the proposed visualization system provides a tool for QA analysis. As part of our future work, we plan to evaluate additional queries and scenarios.
During the preparation of this work, the author(s) used GPT-4 in order to: Grammar and spelling check. After using these tool(s)/service(s), the author(s) reviewed and edited the content as needed and take(s) full responsibility for the publication’s content. [11] AI@Meta, Llama 3 model card (2024). URL: https://github.com/meta-llama/llama3/blob/main/
MODEL_CARD.md. [12] S. Decker, S. Melnik, F. Van Harmelen, D. Fensel, M. Klein, J. Broekstra, M. Erdmann, I. Horrocks,
The semantic web: The roles of xml and rdf, IEEE Internet computing 4 (2000) 63–73. [13] V. Bonstrom, A. Hinze, H. Schweppe, Storing rdf as a graph, in: 2003 First Latin American Web
Congress, IEEE, 2003, pp. 27–36. [14] OpenLink Software, Virtuoso Open-Source Edition, https://virtuoso.openlinksw.com/, 2024. Accessed: 2025-05-01. [15] B. DuCharme, Learning SPARQL: querying and updating with SPARQL 1.1, ” O’Reilly Media, Inc.”, 2013. [16] L. Costabello, A. Bernardi, A. Janik, A. Creo, S. Pai, C. L. Van, R. McGrath, N. McCarthy, P. Tabacof, AmpliGraph: a Library for Representation Learning on Knowledge Graphs, 2019. URL: https: //doi.org/10.5281/zenodo.2595043. doi:10.5281/zenodo.2595043. [17] G. Team, Gemma 3 (2025). URL: https://goo.gle/Gemma3Report.