Associate Professor
Technical University of Denmark
As modern computing systems continue to evolve, cyberattacks have grown in both volume and complexity. Knowledge of these attacks is extensively documented across many structured knowledge bases that aim to support cybersecurity experts and professionals in threat detection and defense. Successful detection and defense, however, require formalization of this knowledge so that machines can effectively process it. In addition, attacks are typically described in natural language, which is inherently ambiguous and makes it hard to (formally) model the available knowledge, ultimately hindering automated machine processing.
One way to solve this issue is to constrain the language used to describe these attacks such that (a) ambiguities are addressed and (b) a formal model can be deterministically compiled from the description. This work designs and implements a controlled natural language (CNL) and its translation process, enabling ambiguity resolution, capturing essential attack features, and translating descriptions into a formal representation. The approach is validated by encoding several attack techniques using the devised language into formal models and confirming their complete translation with the assistance of domain experts. The feasibility of the approach is demonstrated through a working prototype that translates these descriptions to their corresponding models end-to-end. All code and models are public and available online.
In Proceedings of NORDSEC, 2026 (to appear).
Copyright and moral rights for the publications made accessible in the public website are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights.
If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.
Latest website update: 09 November 2026.