AURA: A Multi-Agent Intelligence Framework for Knowledge-Enhanced Cyber Threat Attribution

2025/06/11 by Nanda Rani, Rani, Nanda, Sandeep Kumar Shukla +1 · 2 citations
Computer Science · #Cryptography and Security (cs.CR) #Cybercrime and Law Enforcement Studies #Explainable Artificial Intelligence (XAI) #FOS: Computer and information sciences #Information and Cyber Security

paper · pdf · doi:10.48550/arxiv.2506.10175

openalex publication_date 2025/06/11 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Effective attribution of Advanced Persistent Threats (APTs) increasingly hinges on the ability to correlate behavioral patterns and reason over complex, varied threat intelligence artifacts. We present AURA (Attribution Using Retrieval-Augmented Agents), a multi-agent, knowledge-enhanced framework for automated and interpretable APT attribution. AURA ingests diverse threat data including Tactics, Techniques, and Procedures (TTPs), Indicators of Compromise (IoCs), malware details, adversarial tools, and temporal information, which are processed through a network of collaborative agents. These agents are designed for intelligent query rewriting, context-enriched retrieval from structured threat knowledge bases, and natural language justification of attribution decisions. By combining Retrieval-Augmented Generation (RAG) with Large Language Models (LLMs), AURA enables contextual linking of threat behaviors to known APT groups and supports traceable reasoning across multiple attack phases. Experiments on recent APT campaigns demonstrate AURA's high attribution consistency, expert-aligned justifications, and scalability. This work establishes AURA as a promising direction for advancing transparent, data-driven, and scalable threat attribution using multi-agent intelligence.

Citations

• On Technique Identification and Threat-Actor Attribution using LLMs and Embedding Models
• MaLAware: Automating the Comprehension of Malicious Software Behaviours using Large Language Models (LLMs)
• A Survey on LLM-as-a-Judge
• Chasing the Shadows: TTPs in Action to Attribute Advanced Persistent Threats
• AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation
• Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena
• Evaluating Large Language Models Trained on Code
• Publicly attributing cyber attacks: a framework
• SPoC: Search-based Pseudocode to Code
• "Why Should I Trust You?": Explaining the Predictions of Any Classifier
• Attributing Cyber Attacks

Cited by

• MALCDF: A Distributed Multi-Agent LLM Framework for Real-Time Cyber
• CyberRAG: An Agentic RAG cyber attack classification and reporting tool

Related

• A Comprehensive Survey of Advanced Persistent Threat Attribution: Taxonomy, Methods, Challenges and Open Research Problems
• APT-MMF: An advanced persistent threat actor attribution method based on multimodal and multilevel feature fusion
• Large Language Models for Explainable Threat Intelligence
• Chasing the Shadows: TTPs in Action to Attribute Advanced Persistent Threats
• CyberRAG: An Agentic RAG cyber attack classification and reporting tool