ÖKÖzge Kaçmaz
TR
Back to projects

Bachelor’s thesis2026Knowledge graph, analysis API, and interface development

ThreatGraph AI: Cyber Threat Analysis & Risk Prediction

A bachelor’s thesis that models attacks, tactics, artifacts, and defenses in a 651-node, 2,567-relationship knowledge graph, combining rule-based reasoning and machine learning in one analysis workflow.

  • 651 nodes · 2,567 relationships
  • Inspectable Neo4j graph with Cypher
  • Rules and Random Forest as distinct evidence layers
ArtifactTacticDefenseRelation
Conceptual graph of artifact, tactic, and defense relationships. Threat data → Neo4j graph → Analysis layer → Review interface.
Role

Knowledge graph, analysis API, and interface development

Context

Bachelor’s thesis · 2026

Core stack

Python · FastAPI · Neo4j · Cypher

Scale

651 nodes · 2,567 relationships

Overview

ThreatGraph AI combines attack, tactic, artifact, and defense relationships in a queryable knowledge graph. Rule-based inference and machine learning share one analysis pipeline to produce risk estimates, tactic flows, and defense recommendations.

Problem and goal

When threat indicators live in flat lists, relational context and possible next steps of an attack are easily lost. The goal was to make those connections inspectable while using domain rules and learned signals together.

My role

  • Designed the Neo4j data model and Cypher queries.
  • Combined rule inference and Random Forest analysis in a FastAPI service.
  • Developed a React interface for exploring graph relationships, tactic flows, and recommendations.

Solution

  • Entities were modeled as nodes and meaningful links as directed relationships.
  • Cypher queries retrieved relevant subgraphs while the analysis layer combined rules with ML output.
  • The interface presented graph exploration, risk context, and defense recommendations in one review flow.

Architecture

The system’s main components and data/decision flow are separated as follows.

System overview
01Threat dataAttack · tactic · artifact · defense
02Neo4j graphNodes, relationships, and Cypher paths
03Analysis layerRules and Random Forest
04Review interfaceRisk, flow, and defense guidance

Tech stack

Neo4j · Cypher

Threat relationships and path queries

Python · Random Forest

Inference and risk analysis

FastAPI

Graph and analysis services

React · Vite

Interactive graph exploration

Implementation decisions

  • Model attacks, tactics, artifacts, and defenses with explicit node and relationship types.
  • Show rules and Random Forest output as distinct evidence layers in one analysis.
  • Retrieve relevant subgraphs with Cypher for review alongside risk and defense context.

Results and evaluation

  • Built a queryable threat graph with 651 nodes and 2,567 relationships.
  • Completed a thesis prototype combining rules, ML, and graph queries in one API/interface flow.

Challenges and solutions

  • Heterogeneous threat concepts → a consistent schema with explicit node and relationship types.
  • Explaining layered output → show rules, graph paths, and prediction context separately but together.

What I learned

The work showed that a knowledge graph is not merely a visualization; its schema, queries, and inference logic jointly shape product behavior.

Next projectPDF-Based RAG & MCP Document Assistant