In the previous Part 1 and Part 2 of our LLM and RAG-based cyber threat prediction series, we explored the concepts of cyber threat prediction technology and examined how to combine RAG and XAI to enhance the prediction accuracy of LLMs.
Building upon those discussions, this third installment introduces the comprehensive LLM pipeline that utilizes XAI-integrated RAG to predict potential future cyber threats. Furthermore, we will delve into the technical vision of the T9 Project by explaining its core Detect and Predict architectures based on this pipeline.
Technical Vision of the T9 Project
Traditional single-log-centric cyber threat response, which analyzes individual events independently, faces limitations in countering recent highly sophisticated and complex forms of cyber threats. Therefore, it is urgent to establish an active response system that moves beyond fragmented defense to organically understand the context of attacks and predict subsequent threats.
To address this, the T9 Project aims to build an active security response framework through T9 Detect, which understands data flows to detect threats and provide supporting evidence, and T9 Predict, which forecasts future attacks based on those detections. Let us now examine how such a security response system can be constructed.
LLM & RAG Pipeline for Cyber Threat Prediction
Figure 1. Overview of the LLM and RAG-based Cyber Threat Prediction Pipeline
Figure 1 illustrates the overall pipeline configured for cyber threat prediction, which primarily consists of preprocessing, RAG, and prediction stages. Let us now explore how each stage is structured and what role it plays in the actual threat prediction process.
➀ Data Preprocessing & Feature Extraction
In the data preprocessing and feature extraction stage, the system extracts and refines the information necessary for the LLM to predict future cyber threats based on the provided network packets and detection results.
First, preprocessing is performed on network packets to extract key features reflecting actual network behavior, such as port information, payload length, and protocols. Although identifying information like IP addresses could be utilized during this process, they are excluded from this pipeline to prevent the LLM from relying on specific values and developing a biased perspective during inference; instead, the information is structured around more generalized behavior-based features, such as packet and connection structural behaviors, as well as time-series and traffic flow behaviors.
In addition, MITRE ATT&CK information is retrieved for the detection results to collect attack tactic and attack flow data associated with the detected threat. This allows the pipeline to secure contextual information regarding the significance of the behavior within the overall attack process, moving beyond simple detection results.
➁ RAG
The core of this pipeline, RAG, aims to leverage XAI results to provide the LLM with information highly relevant to the current packet and detection context, as introduced in our previous article.
To achieve this, we first collect security reports containing various historical cyber threat cases and attack flows to construct the RAG Dataset. For the collection of security reports, we utilized publicly available archives of various threat analysis reports, such as APTNotes[1].
Preprocessing operations, such as summarization and keyword extraction, are performed on the collected security reports to organize the attack techniques and associated evidence required for actual prediction. Subsequently, based on this organized data, vector databases such as FAISS[2] and Chroma[3] are utilized to construct the practical RAG Dataset. The RAG Dataset constructed in this manner serves to retrieve information highly relevant to queries generated based on XAI results and provide it to the LLM.
➂ Predict
Once the construction of the RAG Dataset is complete, the process of predicting future attacks using the LLM begins in earnest. At this stage, the LLM synthesizes the packet information extracted from the previous steps, the MITRE ATT&CK definitions for the detected attacks, and the relevant data retrieved from the RAG Dataset to predict the attacks that are most likely to occur next.
In the prediction process, based on the attack stage specified by the user, the system predicts n attack candidates for each stage up to k-steps ahead. The prediction results are provided in JSON format as shown in Figure 2, presenting the MITRE ATT&CK ID, the name of the attack technique, and the rationale for predicting each specific attack.
Figure 2. LLM Prediction Result Example
Integrating T9 Detect and T9 Predict
Aligning with the vision for an active security framework described eariler, our research team anticipates that when T9 Predict, which is based on the LLM and RAG cyber threat prediction pipeline, is integrated with the XAI results of T9 Detect, it will establish an expanded security response system capable of forecasting future attack flows and substantial threats beyond simple detection.
Let us now examine the specific strengths and characteristics of T9 Predict when combined with T9 Detect.
T9 Detect: Understanding and Explaining Data Flows
The key advantage of T9 Detect is that unlike conventional security systems that determine anomalies based on individual logs or events, it is designed to assess the current situation within the overall context based on a dataset tailored to detect data flows and relationships.
More specifically, the T9 Detect model utilizes an encoder structure that processes input data sequentially to incorporate the sequence information of each event, thereby learning temporal changes and context simultaneously. The T9 Detect model trained in this manner leverages stepwise progression points to help evaluate the current situation within the entire flow—namely, the organic causal flow of threat data—rather than focusing on data from a specific, isolated point in time.
Figure 3. Malicious Network Detection Model Architecture
Another key characteristic of T9 Detect is its integration of an XAI structure, which enables it to provide supporting evidence for its detection results. While delivering high detection performance, it is configured to present explainable insights into which features and data flows the model focused on to arrive at each decision. By demonstrating which specific features influenced the detection, which behaviors were deemed anomalous, and where the event stands within the overall timeline, it significantly assists security analysts in rapidly understanding the situation and formulating effective mitigation strategies.
Figure 4. Key Objectives of XAI in Malicious Network Detection
From Reliable Detection to Prediction: T9 Predict Combined with T9 Detect
What synergy can be achieved by combining T9 Detect, which understands data flows to detect anomalies and provide evidence, with the previously discussed LLM and RAG-based prediction pipeline?
Conventional security systems primarily focus on detecting ongoing attacks based on specific, isolated events or logs. However, because actual cyber attacks unfold through a series of progressive stages—such as reconnaissance, initial infiltration, and lateral movement—relying solely on simple detection presents inherent limitations when attempting to forecast subsequent malicious actions.
However, T9 Detect understands the current attack situation based on data flows and the relationships between events, providing key features and evidence that influenced the detection results through XAI. These detection and explanation outputs can be utilized even more effectively when integrated with T9 Predict, our LLM and RAG-based prediction architecture. T9 Predict filters out only the highly significant features using XAI to generate RAG search queries, and based on this, retrieves historical attack cases and MITRE ATT&CK information related to the current situation to feed into the LLM.
This allows the LLM to go beyond simple current-state analysis and more reliably predict the attacker’s next moves and future attack flows. Consequently, T9 Detect performs the role of detecting and explaining the current attack situation, while T9 Predict leverages this foundation to forecast future attacks. This synergy establishes an active cyber threat response framework capable of countering future attacks rather than merely reacting to basic detection.
Figure 5. Example of the Integrated T9 Detect and T9 Predict Pipeline
Conclusion
In this three-part series on LLM and RAG-based cyber threat prediction, Part 1 introduced the limitations of conventional cyber threat prediction alongside LLM and RAG-based approaches. Part 2 explained methods for combining XAI and RAG to achieve more accurate predictions. Following those, this third installment has introduced the configuration of the actual prediction pipeline, as well as the technical vision and philosophy of the T9 Project—an integrated cyber threat response framework connecting detection to prediction through the combination of T9 Detect and T9 Predict.
In particular, the integration of T9 Detect and T9 Predict holds a distinct advantage over conventional security frameworks, as it moves beyond merely detecting ongoing attacks to understanding the attack flow and forecasting the future behavior of adversaries. Furthermore, by leveraging an XAI-based explainable architecture to deliver the underlying rationale alongside the predictions, we anticipate that this system will enable more reliable and proactive responses within practical security operations center (SOC) environments.
Moving forward, the T9 Project will continuously advance AI-based detection and prediction technologies to establish a more practical, next-generation security response framework. T9 Detect, which is currently under development, is being prepared with the goal of public release this coming September. Following that, various research initiatives and functionalities linked with T9 Predict will also be introduced sequentially, so we appreciate your continued interest.
References
[1] Z. Hogan and A. Lee, “APTnotes,” GitHub repository. Available: https://github.com/aptnotes/data
[2] J. Johnson, M. Douze, and H. Jégou, “Billion-scale similarity search with GPUs,” IEEE Transactions on Big Data, vol. 7, no. 3, pp. 535–547, 2019.
[3] Chroma, “Chroma: AI-native open-source embedding database,” GitHub repository. Available: https://github.com/chroma-core/chroma
KAIST 사이버보안연구센터 AI 기술보안팀 연구원으로 AI 및 LLM을 이용한 보안 연구를 수행하고 있다.