Semantic-Incremental Rough-Set Framework for Adaptive and Explainable Cyber Threat Intelligence

This research develops a semantic–incremental rough-set framework that connects an organization’s business context and Priority Intelligence Requirements (PIRs) with real-world Cyber Threat Intelligence (CTI). Using Large Language Models (LLMs) and ontology-based semantic mapping, the study will construct shared semantic vectors representing business assets and intelligence priorities, fusing them into a business–intelligence relevance vector. Each PIR will be modeled as a decision class, while asset attributes such as type, criticality, and business value will define the business-context vector. Incoming CTI objects will populate the information system and be evaluated for relevance through a similarity function. An incremental rough-set engine will maintain and update this mapping as threats or business conditions change, providing a continuous, efficient, and explainable mechanism for PIR alignment, threat prioritization, and adaptive CTI analysis.