NeuroGraph: An AI Graph-Driven Neuro-Symbolic Framework for Explainable Threat Reasoning in Advanced Manufacturing
cs.CR, cs.IR
Submitted: 2026-09-01
Updated: 2026-09-08
Comments: Submission to Springer:Journal of Information Security (Peer Review)
Code: https://github.com/ahmadspm/Resellient-Industry-5.0
Project page: https://oasis-open.github.io/cti-documentation
License: http://creativecommons.org/licenses/by-nc-nd/4.0/
The gist: The growing complexity of cyber-physical attack surfaces in advanced manufacturing has made cyber threat intelligence analysis increasingly difficult.
Terminology
Abstract
The growing complexity of cyber-physical attack surfaces in advanced manufacturing has made cyber threat intelligence analysis increasingly difficult. Although large language models and retrieval-augmented generation have improved CTI workflows, text-based approaches remain vulnerable to hallucinations and provide limited support for structured reasoning over interconnected threats. Graph-based RAG reduces some of these limitations, but existing approaches often lack ontology-consistent multi-hop reasoning and transparent evidence tracing across heterogeneous cybersecurity data. This paper proposes a graph-grounded neuro-symbolic framework that integrates ontology-aware symbolic query generation, knowledge graph retrieval, and neural language generation to support accurate and explainable threat analysis across information technology and operational technology environments. The framework adopts a dual-large language model architecture: the first model translates natural-language questions into executable Cypher queries for symbolic graph retrieval, while the second generates answers strictly from the retrieved graph evidence. Experimental evaluation using publicly available cyber threat intelligence benchmarks shows consistent improvements over the published baseline in reasoning accuracy, while also reducing hallucinations, strengthening multi-hop reasoning, and improving robustness to adversarial perturbations. Runtime and explainability analyses further demonstrate that the framework maintains interactive inference performance and exposes graph-grounded reasoning artifacts that allow analysts to inspect and verify each stage of the analysis. Overall, the results highlight the potential of graph-grounded neuro-symbolic reasoning as a scalable, interpretable, and reliable approach to cyber threat intelligence for next-generation Industry 5.0 environments.
Sources
- Threat-based Security Controls to Protect Industrial Control Systems
- Adapting Large Language Models to Emerging Cybersecurity using Retrieval Augmented Generation
- Multi-Agent GraphRAG: A Text-to-Cypher Framework for Labeled Property Graphs
- TRACE the Evidence: Constructing Knowledge-Grounded Reasoning Chains for Retrieval-Augmented Generation
- Benchmarking Large Language Models in Retrieval-Augmented Generation
- A Survey of Graph Retrieval-Augmented Generation for Customized Large Language Models
- Structuring Security: A Survey of Cybersecurity Ontologies, Semantic Log Processing, and LLMs Application
- Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks
- SimGRAG: Leveraging Similar Subgraphs for Knowledge Graphs Driven Retrieval-Augmented Generation
- Knowledge Graph-Guided Retrieval Augmented Generation
- GRAG: Graph Retrieval-Augmented Generation
- How Reliable are LLMs as Knowledge Bases? Re-thinking Facutality and Consistency
- Dense Passage Retrieval for Open-Domain Question Answering
- LLM as a Mastermind: A Survey of Strategic Reasoning with Large Language Models
- REALM: Retrieval-Augmented Language Model Pre-Training
- Think-on-Graph 2.0: Deep and Faithful Large Language Model Reasoning with Knowledge-guided Retrieval Augmented Generation
- Retrieval-Augmented Generation with Graphs (GraphRAG)
- GNN-RAG: Graph Neural Retrieval for Large Language Model Reasoning
- MoRSE: Bridging the Gap in Cybersecurity Expertise with Retrieval Augmented Generation
- GraphRAG under Fire
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs