Enabling Transparent Cyber Threat Intelligence Combining Large Language Models and Domain Ontologies

LLMs need structural guardrails to be trustworthy for security work: The paper shows that combining Large Language Models with domain ontologies and SHACL constraints significantly improves accuracy in identifying cyber threats compared to using LLMs alone with simple prompts, demonstrating that AI systems perform better when constrained by expert-defined rules rather than left to generate outputs freely.

Explainability matters more than speed in cybersecurity AI: The researchers deliberately prioritized extraction quality and transparency over processing speed, recognizing that security professionals need to understand why an AI flagged something as malicious—not just get fast answers—to make informed decisions about potential threats.

Domain expertise should guide AI system design: The methodology was specifically motivated by the analytical requirements of cybersecurity professionals working with honeypot data, illustrating that responsible AI development requires deep collaboration with domain experts rather than applying generic AI solutions to specialized problems.

Structured knowledge representation enhances AI accountability: By organizing extracted information into an ontology-enriched graph database with semantic validity constraints, the system creates an auditable record of how threats were identified and classified, supporting transparency and the ability to trace AI decisions back to their reasoning.