{"ID":5937110,"CreatedAt":"2026-07-07T03:14:33.014478982Z","UpdatedAt":"2026-07-09T12:40:20.160756429Z","DeletedAt":null,"paper_url":"https://arxiv.org/abs/2607.05001","arxiv_id":"2607.05001","title":"TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction","abstract":"Cyber Threat Intelligence (CTI) reports are predominantly unstructured, heterogeneous, and noisy, which limits their direct usability for automated analysis and reasoning. Cybersecurity Knowledge Graphs (CSKGs) provide a structured representation of adversarial entities, actions, and relations, but constructing such graphs from free-text CTI remains a challenge. Recent approaches rely on monolithic Large Language Models (LLMs) to perform end-to-end extraction and completion, leading to high cost, limited controllability, and unstable performance. This paper introduces TACTIC-KG, an agentic framework for CSKG construction that decomposes the task into modular, specialized LLM agents responsible for extraction, typing, verification, and curation. Using lightweight models (3B--8B), TACTIC-KG improves stability, recall, and graph consistency while reducing deployment cost. We implement and evaluate TACTIC-KG against recent state-of-the-art systems. Experiments on human-annotated CTI reports show that agent specialization consistently outperforms larger monolithic in-context-learning (ICL) baselines in extraction F1-score, typing accuracy, and structural graph similarity.","short_abstract":"Cyber Threat Intelligence (CTI) reports are predominantly unstructured, heterogeneous, and noisy, which limits their direct usability for automated analysis and reasoning. Cybersecurity Knowledge Graphs (CSKGs) provide a structured representation of adversarial entities, actions, and relations, but constructing such gr...","url_abs":"https://arxiv.org/abs/2607.05001","url_pdf":"https://arxiv.org/pdf/2607.05001v1","authors":"[\"Mouhamed Amine Bouchiha\",\"Gregory Blanc\"]","published":"2026-07-06T12:41:11Z","proceeding":"cs.CR","tasks":"[\"cs.CR\",\"cs.AI\",\"cs.LG\",\"cs.MA\"]","methods":"[\"Large Language Model\",\"Language Model\"]","has_code":false}