CyRAG: Retrieval Augmented Generation for Robust Cyber Defense
summary
CyRAG integrates CVE, CWE, CAPEC and ATT&CK into a retrieval-augmented LLM pipeline and stores interconnected threat intelligence in a Neo4j knowledge graph. Automated daily and weekly ETL populates the graph; a B2W Siamese encoder maps CVEs to CWEs and a T5-style seq2seq model maps CWEs to CAPECs, improving few‑shot performance. Graph‑science link prediction and topology metrics discover implicit edges (e.g., 14 common neighbors and Adamic score 5.41) and case studies surface real-world chains such as Scattered Spider → exploited vulnerabilities → mitigations.
AI-written summary · about
chapters (11)
- 0:00Introduction and motivation
- 1:09Cybersecurity as battle between good and bad
- 3:37Vulnerabilities and weaknesses overview
- 6:28Mapping vulnerabilities to weaknesses
- 9:57Linking weaknesses to attack patterns
- 12:27Building the knowledge graph
- 16:44Automated pipeline and updates
- 18:55Case studies with top 25 CWEs
- 20:20Threat group analysis examples
- 22:51Predicting new relationships
- 24:41Conclusion and future work
related talks
35mComplex Querying of Cyber Knowledge Graph for Robust Cyber Defense
26mImproving Cybersecurity Posture with an AI Security Assistant
30mCybersecurity Risk Assessment Using LLM Agents and Graph Data Science
41mMerging Human Cyber Security Expertise with Generative AI
01h 17mGraph Database and Retrieval Augmented Generation
40mRAG Pipeline Evaluation
57mVulnerability Root Cause Mapping with CWE
20mAttack of the Graph: Visual Tools for Cyber Analysis