What the study found
The study found that OntoLogX, an autonomous AI agent, can transform raw cybersecurity logs into ontology-grounded knowledge graphs. The authors also report that it can aggregate these graphs into sessions and predict MITRE ATT&CK tactics, a framework for describing adversary behavior.
Why the authors say this matters
The authors say this matters because system logs contain cyber threat intelligence, but that information is often hard to use due to noise, inconsistent meaning, and fragmentation. The study suggests that reconciling logs into coherent, interoperable knowledge graphs can help extract actionable cyber threat intelligence.
What the researchers tested
The researchers tested OntoLogX, which combines a lightweight log ontology, retrieval augmented generation, and iterative correction steps. They evaluated it on public datasets and real-world honeypot datasets, and they used multiple LLM backends.
What worked and what didn't
The paper reports robust knowledge graph generation across multiple LLM backends. It also reports accurate mapping of adversarial activity to MITRE ATT&CK tactics, and says the method produced ontology-compliant knowledge graphs.
What to keep in mind
The abstract does not provide detailed limitations or failure cases. It also does not give numerical results or specific comparison baselines in the available summary.
Key points
- OntoLogX transforms raw cybersecurity logs into ontology-grounded knowledge graphs.
- The system uses a lightweight log ontology, retrieval augmented generation, and iterative correction.
- It aggregates knowledge graphs into sessions and predicts MITRE ATT&CK tactics.
- The authors evaluated the system on public and real-world honeypot datasets.
- The abstract reports robust graph generation across multiple LLM backends.
Disclosure
- Research title:
- OntoLogX turns cybersecurity logs into ontology-grounded knowledge graphs
- Authors:
- Luca Cotti, Idílio Drago, Anisa Rula, Devis Bianchini, Federico Cerutti
- Institutions:
- Cardiff University, Department of Medical Sciences, University of Brescia, University of Brescia, University of Brescia, University of Brescia, University of Southampton, University of Turin
- Publication date:
- 2026-04-23
- OpenAlex record:
- View
Get the weekly research newsletter
Stay current with scholarly research without reading academic papers — one filtered digest, every Friday.