ThreatCraft: Automated Attack Scenario Generation via Hybrid Rule-Based and LLM-Driven Reasoning

Abstract

Recently, the growing complexity of modern Information Technology (IT) systems has made it increasingly difficult to identify realistic attack scenarios. Although various automated approaches have been proposed, challenges such as dependence on expert knowledge and hallucinations in LLM-based methods remain unresolved. We develop ThreatCraft, an attack-scenario generation tool that combines a rule-based engine with Large Language Models (LLMs). ThreatCraft constructs system-level attack paths using a Unified Kill Chain (UKC) and leverages them to guide LLMs in generating detailed attack scenarios. Experimental results across automotive, Industrial Control Systems (ICS), and enterprise domains show that ThreatCraft achieves an average F1-score of 0.984 and a semantic similarity score of 0.893, improving attack-path reconstruction accuracy and semantic similarity by up to 8.3% and 10.7%, respectively, compared with other tools. These results demonstrate that ThreatCraft can consistently generate realistic and structurally coherent attack scenarios across various domains. GitHub:https://github.com/HackProof/2026_ASE_ThreatCraft.git Demo:https://youtu.be/nrIHEKDLp2E