一句话：提出结合规则引擎与大语言模型的攻击场景生成工具，用统一杀伤链引导 LLM 生成结构化攻击路径。
现代 IT 系统日益复杂，识别真实可行的攻击场景变得愈发困难。已有自动化方法要么依赖专家知识，要么存在 LLM 幻觉问题。本文提出 ThreatCraft，一种将规则引擎与大语言模型相结合的混合式攻击场景生成工具：先由规则引擎基于统一杀伤链（Unified Kill Chain, UKC）构造系统级攻击路径，再以这些路径作为结构化约束引导 LLM 生成细粒度的攻击场景描述，从而在保证逻辑连贯性的同时利用 LLM 的生成能力。作者在汽车、工业控制系统（ICS）与企业三个领域开展实验，ThreatCraft 取得平均 0.984 的 F1 分数与 0.893 的语义相似度，相比同类工具在攻击路径重构准确率与语义相似度上分别最高提升 8.3% 与 10.7%。结果表明该方法能够在不同领域稳定生成真实且结构一致的攻击场景，并提供了开源实现与演示。
Recently, the growing complexity of modern Information Technology (IT) systems has made it increasingly difficult to identify realistic attack scenarios. Although various automated approaches have been proposed, challenges such as dependence on expert knowledge and hallucinations in LLM-based methods remain unresolved. We develop ThreatCraft, an attack-scenario generation tool that combines a rule-based engine with Large Language Models (LLMs). ThreatCraft constructs system-level attack paths using a Unified Kill Chain (UKC) and leverages them to guide LLMs in generating detailed attack scenarios. Experimental results across automotive, Industrial Control Systems (ICS), and enterprise domains show that ThreatCraft achieves an average F1-score of 0.984 and a semantic similarity score of 0.893, improving attack-path reconstruction accuracy and semantic similarity by up to 8.3% and 10.7%, respectively, compared with other tools. These results demonstrate that ThreatCraft can consistently generate realistic and structurally coherent attack scenarios across various domains. GitHub:https://github.com/HackProof/2026_ASE_ThreatCraft.git Demo:https://youtu.be/nrIHEKDLp2E
@inproceedings{paperbot12316,
title = {ThreatCraft: Automated Attack Scenario Generation via Hybrid Rule-Based and LLM-Driven Reasoning},
author = {Dohee Kang and Jiwon Kwak and Geunwoo Baek and Seungjoo Kim},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834608}
}