Construction Method for Universal Threat Intelligence Knowledge Graph Based on MCP Agent
Author:
Affiliation:

Clc Number:

TP309

Fund Project:

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    With the increasing complexity of cyber attacks, the collection and integration of threat intelligence face challenges of fragmentation. In this context, enterprises have begun building private threat intelligence knowledge graph systems. However, traditional construction methods suffer from inefficiency and limited effectiveness due to inaccurate extraction of entities and their relationships. To address these issues, this study proposes OPFA: a general threat intelligence knowledge graph construction framework based on model context protocol (MCP) agents. Through dynamic semantic subject positioning, large language model prompt templates are fine-tuned to drive agents to extract threat entities and their relationships. These threat entities and relationships are automatically created as nodes and edges in the knowledge graph, and threat intelligence is then linked through entity attribute value matching to form a complete knowledge graph. The system subsequently retrieves MCP resources for critical threat entities (such as vulnerabilities and malicious samples) to achieve customized knowledge graph expansion. Experimental results demonstrate that the agents not only improve Precision (97.22% and 97.83%, respectively), Recall (90.91% and 95.52%, respectively), and F1-score (94.44% and 96.66%, respectively) in threat entity and entity relationship extraction, but also effectively enhance the construction efficiency of the knowledge graph.

    Reference
    Related
    Cited by
Get Citation

沙乐天,薛磊,陈霄,李德强,肖甫.基于MCP智能体的通用威胁情报知识图谱构建方法.软件学报,,():1-19

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:April 21,2025
  • Revised:September 28,2025
  • Adopted:
  • Online: July 15,2026
  • Published:
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-4
Address:4# South Fourth Street, Zhong Guan Cun, Beijing 100190,Postal Code:100190
Phone:010-62562563 Fax:010-62562533 Email:jos@iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063