• 

  LLM Agent interaction

• 

  Cyberthreat Graph based on CVE & MITRE attack data

Project Story

Inspiration

As cyber threats grow increasingly sophisticated, security teams face a critical challenge: making sense of disparate threat data to protect what matters most. The inspiration for CyberThreat PathFinder came from witnessing security analysts struggle to connect the dots between vulnerabilities, threat actors, and critical assets. Traditional security tools generate alerts and data but fail to answer the crucial question: "How could attackers reach our crown jewels?"

What it does

CyberThreat PathFinder transforms complex threat data into actionable intelligence by:

• Visualizing attack paths from threat actors to critical assets
• Analyzing vulnerabilities in context of exploitability and impact
• Profiling threat actor techniques and capabilities
• Providing risk-based recommendations for security teams
• Enabling natural language queries across the threat landscape
• Delivering graph-based insights through an intuitive interface

How I built it

I constructed CyberThreat PathFinder using:

• ArangoDB for the graph database backend
• NetworkX and nx-arangodb for efficient graph analytics
• Local Mistral LLM integrated via LangChain for natural language processing
• MITRE ATT&CK framework and CVE data for threat intelligence
• Custom graph algorithms for attack path discovery
• Matplotlib for dynamic threat visualizations
• Interactive UI components within Google Colab

Challenges I ran into

Building the system presented several challenges:

• Normalizing data from diverse threat intelligence sources
• Ensuring meaningful graph connectivity for realistic attack paths
• Fine-tuning LLM prompts for consistent cybersecurity analysis
• Optimizing performance for complex graph traversals
• Handling incomplete or contradictory threat information
• Securing database credentials in a cloud environment

Accomplishments that I am proud of

I am particularly proud of:

• Creating a fully local, privacy-preserving LLM agent for security analysis
• Developing intuitive visualizations that make complex threats understandable
• Implementing intelligent risk scoring based on multiple factors
• Building robust error handling to provide value even with incomplete data
• Enabling natural language querying of complex graph relationships

What I learned

The project taught us valuable lessons about:

• The power of graph databases for modeling interconnected security entities
• Effective prompt engineering for security-focused LLMs
• Balancing technical depth with user-friendly outputs
• The importance of multi-factor risk analysis for meaningful prioritization
• How the MITRE ATT&CK framework can structure threat actor analysis

What's next for CyberThreat PathFinder

Future development plans include:

• Integration with real-time threat intelligence feeds
• Temporal analysis to track threat evolution over time
• Integration with SIEM and SOAR platforms
• Advanced countermeasure simulation and "what-if" analysis
• Expanded visualization capabilities using 3D graph rendering
• Mobile compatibility for on-the-go security analysis

Built With

• arangodb
• cugraph
• langchain
• mistral
• ollama
• python