OntoLogX: Ontology‐guided knowledge graph extraction from cybersecurity logs with large language models

Cotti, Luca, Drago, Idilio, Rula, Anisa, Bianchini, Devis and Cerutti, Federico ORCID: https://orcid.org/0000-0003-0755-0358 2026. OntoLogX: Ontology‐guided knowledge graph extraction from cybersecurity logs with large language models. Advanced Intelligent Systems 8 (6) , e202501381. 10.1002/aisy.202501381

PDF - Published Version Available under License Creative Commons Attribution. Download (4MB)

Abstract

System logs represent a valuable source of cyber threat intelligence (CTI), capturing attacker behaviors, exploited vulnerabilities, and traces of malicious activity. Yet their utility is often limited by a lack of structure, semantic inconsistency, and fragmentation across devices and sessions. Extracting actionable CTI from logs, therefore, requires approaches that can reconcile noisy, heterogeneous data into coherent and interoperable representations. We introduce OntoLogX, an autonomous AI agent that leverages large language models (LLMs) to transform raw logs into ontology‐grounded knowledge graphs (KGs). OntoLogX integrates a lightweight log ontology with retrieval augmented generation and iterative correction steps, ensuring that generated KGs are syntactically and semantically valid. Beyond event‐level analysis, the system aggregates KGs into sessions and employs a LLM to predict MITRE ATT&CK tactics, linking low‐level log evidence to higher‐level adversarial objectives. We evaluate OntoLogX on both public and real‐world honeypot datasets, demonstrating robust KG generation across multiple LLMs backends and accurate mapping of adversarial activity to MITRE ATT&CK tactics. Results highlight the effectiveness of the methodology in constructing ontology‐compliant KGs, along with their value in extracting actionable CTI.

Item Type:	Article
Date Type:	Publication
Status:	Published
Schools:	Schools > Computer Science & Informatics
Additional Information:	License information from Publisher: LICENSE 1: URL: http://creativecommons.org/licenses/by/4.0/
Publisher:	Wiley
ISSN:	2640-4567
Date of First Compliant Deposit:	27 April 2026
Date of Acceptance:	12 March 2026
Last Modified:	04 Aug 2026 11:02
URI:	https://orca.cardiff.ac.uk/id/eprint/186655

Actions (repository staff only)

Edit Item