A Cyber Threat Intelligence Knowledge Graph for Exploit Link Prediction and Asset Risk Scoring

Existing CTI knowledge graph work stops at construction, extracting entities and relations from text but never reasoning over the finished graph. This study closes that gap by building a graph from structured feeds (MITRE ATT&CK, NVD, CISA KEV) and adding two reasoning layers: RotatE-based exploit link prediction, which roughly doubles the TransE baseline (MRR 0.173 vs 0.077), and an explainable graph-proximity risk score that ranks internal assets down to the CVE and actor behind each score. It also benchmarks LLM-based graph reconstruction against the same graph, showing structured feeds and text extraction are complementary. The core contribution is turning a static CTI graph into a tool that answers the questions analysts actually ask.