Advancing Threat Modeling with Semantic Knowledge Graphs

Threats, assets, mitigations and incidents as nodes in a semantic knowledge graph, with MGraph-DB as the memory-first store — so overlaying STRIDE, MITRE ATT&CK and the OWASP Top 10 on one system becomes a query, not a workshop.

What it argues

• Five named failure modes of today's practice: subjectivity and inconsistency, siloed knowledge (models live in prose no machine can read), lack of scalability against daily deployments, fragmented methodologies (STRIDE, PASTA, LINDDUN, attack trees each a perspective, none linkable), and static, context-poor models that never absorb new threat intelligence.
• The mechanism: Asset, Threat, Vulnerability, Mitigation/Control, Actor and Incident as node types, with defined relationships — Threat targets Asset, Mitigation mitigates Threat, Incident is-instance-of Threat.
• Three claimed consequences, presented on this site as testable rather than as benefits: multi-framework overlay becomes a query; analysis becomes graph traversal; new context (a CVE, a peer-industry incident, an ISO 27001 control) becomes an edge rather than a rewrite.
• The determinism caveat, carried over from the source: letting an LLM “fill in relationships freely” is a prototype behaviour; an explicit schema is what the paper calls crucial for reliability.

What checks it

This paper states a mechanism and a set of consequences. The ThreatModCon 2025 vault is the working proof at the scale this and the sibling papers argue for — not a demo built to illustrate the paper, but a published vault carrying real graph data (51 nodes, 179 threats across eleven linked layers). /validated/ is the sharper instance: a threat model checked, finding by finding, against the code it describes.