Metraipolis › archive › dc_05f32abc30ca

MITRE-SAGE: A Multi-Agent Cybersecurity Question-Answering Model — arXiv:2608.16921

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.16921
License (as archived): CC0-1.0
Archived: 2026-10-18T14:48:51.655Z
SHA-256 of the archived text: c48d77195b2da16794a855c95bfaed50389a97b7828b9c1a242a3bbde36f0f0b
Stable URL of this page: https://metraipolis.com/documento/dc_05f32abc30ca

How to cite

MITRE-SAGE: A Multi-Agent Cybersecurity Question-Answering Model — arXiv:2608.16921 — arXiv (en), https://arxiv.org/abs/2608.16921 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_05f32abc30ca (Metraipolis archive dc_05f32abc30ca, sha256 c48d77195b2da16794a855c95bfaed50389a97b7828b9c1a242a3bbde36f0f0b)

BibTeX

@misc{dc05f32abc30ca,
  title = {MITRE-SAGE: A Multi-Agent Cybersecurity Question-Answering Model — arXiv:2608.16921},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.16921},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_05f32abc30ca; sha256 c48d77195b2da16794a855c95bfaed50389a97b7828b9c1a242a3bbde36f0f0b},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.16921. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Effective cybersecurity operations require timely and accurate analysis of large-scale heterogeneous security information; however, analysts increasingly struggle with information overload, alert fatigue, and time-constrained decision-making. Although large language models (LLMs) have demonstrated promising capabilities for question answering (QA), their effectiveness in cybersecurity remains limited by insufficient domain knowledge, a tendency to hallucinate, and difficulties in capturing both semantic and structural relationships. This work proposes MITRE-SAGE, a multi-agent retrieval-augmented generation framework that integrates semantic and structural cybersecurity knowledge to improve the reliability and interpretability of LLM-based QA systems. By decomposing complex tasks into query interpretation, evidence retrieval, and answer synthesis, MITRE-SAGE effectively supports cybersecurity tasks such as vulnerability assessment, threat profiling, and relationship extraction. Furthermore, we propose MITRE-QA, a comprehensive benchmark comprising 3,000 question-answer pairs for evaluating LLMs across diverse cybersecurity knowledge tasks, and use it to systematically evaluate MITRE-SAGE against representative baseline methods. Extensive experiments demonstrate that MITRE-SAGE consistently outperforms standalone LLMs and conventional RAG approaches. Notably, a lightweight configuration comprising Qwen2.5-7B sub-agents and a Qwen2.5-14B orchestrator achieves superior performance on five of the eight benchmark tasks, indicating the effectiveness of the proposed multi-agent framework. The results highlight the potential of MITRE-SAGE as a scalable and interpretable approach for reliable cybersecurity QA, while MITRE-QA provides a standardized benchmark for future research.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-08-19 in cs.LG).
Categorie arXiv: Information Retrieval (cs.IR) ; Cryptography and Security (cs.CR); Machine Learning (cs.LG); Multiagent Systems (cs.MA).
Pagina del lavoro: https://arxiv.org/abs/2608.16921 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-18T14:47:59.433Z dalla pagina https://arxiv.org/catchup/cs.LG/2026-08-19?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).