GARAGE: Characterizing the Automation Boundary in LLM-based Attack Graph Generation

arXiv:2607.18108 · cs.CR · Submitted 2026-07-20 · Read on arXiv

Daekwon Pi, Sangho Lee, Young Hun Lee, Huy Kang Kim

cs.CR

Submitted: 2026-07-20

Comments: 22 pages, 10 figures, 12 tables

License: http://creativecommons.org/licenses/by/4.0/

The gist: While modern vehicle security depends on effective Cyber Threat Intelligence (CTI) synthesis, current automated tools struggle with unstructured data and automotive-specific architectural nuances.

Terminology

Abstract

While modern vehicle security depends on effective Cyber Threat Intelligence (CTI) synthesis, current automated tools struggle with unstructured data and automotive-specific architectural nuances. To bridge this gap, we introduce GARAGE, a RAG-powered framework that converts fragmented CTI into an actionable, domain-specific knowledge base for automated attack graph generation. GARAGE synthesizes a dataset of 12,786 CVEs and 140 incident reports into a STIX 2.1 and Auto-ISAC ATM-compliant knowledge base. By formalizing tactical-pattern-level scenarios through granular kill chain analysis, GARAGE achieves threat generation capabilities. Our 320 Leave-One-Out experiments reveal that the framework can accurately transfer security knowledge to entirely unseen vehicle architectures. Furthermore, we position GARAGE as a scalable TARA support tool within human-in-the-loop workflows, offering a comprehensive cost-performance analysis to guide its deployment across various LLM tiers.

Sources

Related papers