KGCS Case Studies — Real-World Threat Analysis

Welcome to the KGCS Case Studies repository. These documents demonstrate how the Knowledge Graph for Cybersecurity Standards (KGCS) enables deterministic, standards-backed security reasoning through real-world vulnerability scenarios.

What You'll Learn

Each case study walks through a complete cybersecurity threat chain:

1. Vulnerability Discovery — What is the CVE, and why is it critical?
2. Root Cause Analysis — Understanding the underlying weakness (CWE)
3. Attack Scenarios — How attackers exploit this (CAPEC → ATT&CK mappings)
4. Detection Coverage — What tools can detect this attack (CAR analytics)
5. Defense Playbook — How to mitigate and defend (D3FEND, SHIELD, ENGAGE)
6. Reasoning Walkthrough — Step-by-step KGCS agent analysis
7. Live Query Examples — Real request/response payloads from agents

N.B. Section 8 (LLM comparison) is deferred to a future phase but will show how KGCS deterministic reasoning compares to free-form LLM answers.

Learning Pathways

For Security Developers

Start here: Log4j RCE (CVE-2021-44228)

• Path: Attack Scenarios → Detection Coverage → Reasoning Walkthrough
• Goal: Understand how queries map attacks to defenses
• Deliverable: Cypher templates you can reuse

For Security Researchers & Architects

Start here: SQL Injection (CWE-89 Family)

• Path: Root Cause Analysis → Attack Scenarios → Defense Playbook
• Goal: See how KGCS unifies variant-level weaknesses across multiple CVEs
• Deliverable: Mapping templates for adding new standards

For Risk & Compliance Officers

Start here: Path Traversal (CWE-22)

• Path: Vulnerability Overview → Defense Playbook → Detection Coverage
• Goal: Understand platform impact and defensive coverage gaps
• Deliverable: Risk assessment frameworks

Case Study Overview

Case Study 1: Log4j RCE (CVE-2021-44228)

Status: Complete (sections 1-7) + Placeholder (section 8)

Quick Facts:

• Severity: CVSS 10.0 (Critical)
• Impact: Affected 619,861 platform configurations
• Root Cause: CWE-91 (Improper Neutralization)
• Attack Vector: CAPEC-88 (OS Command Injection), CAPEC-242 (Code Injection)
• ATT&CK Technique: T1059 (Command and Scripting Interpreter)
• Defensive Controls: 27+ from D3FEND, CAR, SHIELD, ENGAGE
• Timeline: Discovered Dec 24, 2021 → Patches available → Mass exploitation

Why This Case Study?

• Highest-impact real-world CVE
• Complex causal chain showing all stages of KGCS
• Well-documented attack vectors and defensive controls
• Demonstrates scalability (619K+ affected systems)

Read: Log4j Case Study

Case Study 2: SQL Injection (CWE-89)

Status: Complete (sections 1-7) + Placeholder (section 8)

Quick Facts:

• Category: Injection attacks
• Root Cause: CWE-89 (Improper Neutralization of Special SQL Command)
• Abstraction: Base class for all SQL injection variants
• Impact: Code execution in database context
• Attack Vectors: CAPEC-66 (SQL Injection), CAPEC-250 (XML Injection Pattern)
• Progression: Injection → Code execution → Data breach → Privilege escalation
• Scale: Affects applications in every technology stack

Why This Case Study?

• Foundational vulnerability type (most common)
• Shows how KGCS unifies multiple CVEs → one CWE
• Demonstrates platform-independent threat modeling
• Multiple CAPEC patterns showing attack diversity

Read: SQL Injection Case Study

Case Study 3: Path Traversal (CWE-22)

Status: Complete (sections 1-7) + Placeholder (section 8)

Quick Facts:

• Root Cause: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
• Variant: One of the most prevalent weaknesses across all systems
• Attack Vectors: CAPEC-107, CAPEC-167, CAPEC-177
• Impact: Unauthorized file/directory access
• Scope: Platform-independent (affects web apps, APIs, CLI tools)
• Detection Patterns: Consistent across different tools/frameworks

Why This Case Study?

• Single weakness affecting billions of systems
• Multiple CAPEC patterns (different exploitation methods)
• Shows consistency of KGCS across diverse platforms
• Good example for threat modeling at scale

Read: Path Traversal Case Study

How KGCS Works (Quick Intro)

The causal chain for any vulnerability:

CVE (Specific vulnerability)
  ↓ caused by
CWE (Root weakness)
  ↓ demonstrated by
CAPEC (Attack patterns)
  ↓ implements
ATT&CK (Techniques & Tactics)
  ↓ mitigated/detected by
D3FEND + CAR + SHIELD + ENGAGE (Defensive controls)

KGCS materializes all edges in this chain across 5.7M nodes and 27.5M relationships. Every claim is:

• Traceable to a standard (NVD, MITRE, etc.)
• Verifiable (query the graph)
• Deterministic (same query = same answer, always)
• Transparent (confidence score shows data quality)

Key Concepts

Confidence Scoring

Each agent response includes a confidence score (0-1) with:

• Basis: Why we're confident (hop count, coverage level, etc.)
• Signals: What factors increased/decreased confidence
• Degradation: What would make us less confident

Example: "Confidence 0.9 (basis: 2 hops, all required edges present)"

Provenance Tracking

Every fact is attributed to its source:

• NVD — CVE/CVSS data
• MITRE CAPEC — Attack patterns
• MITRE ATT&CK — Techniques & tactics
• MITRE D3FEND — Defensive techniques
• MITRE CAR — Detection analytics
• MITRE SHIELD — Deception tactics
• MITRE ENGAGE — Engagement concepts

Causal Chain Integrity

KGCS validates that:

• Every CVE maps to a CWE
• Every CWE maps to CAPEC(s)
• Every CAPEC maps to T-codes (ATT&CK)
• Every T-code has defensive controls
• No hops are skipped

For Developers: Adding Your Own Case Studies

See the Case Study Template to create a new case study for any CVE/CWE/threat scenario.

Requirements:

• Verify data against NVD, MITRE, and KGCS graph
• Follow the 8-section structure
• Include Cypher query examples
• Demonstrate provenance tracking
• Calculate confidence scores

Post-publication:

• Update PUBLISHING_MANIFEST.md
• Add link to this README
• Submit PR with case study

Frequently Asked Questions

Q: Why 619,861 affected platforms for Log4j?

A: The KGCS graph includes all CPE platform configurations that match Log4j versions between 2.0 and 2.14. This represents the platform surface where the vulnerability applies (before patches).

Q: How does KGCS differ from a manual vulnerability database search?

A: KGCS automatically materializes the causal chain (CVE → CWE → CAPEC → ATT&CK → Defenses). You don't manually search five different databases—the ontology connects them.

Q: Can I query the graph directly?

A: Yes! The 06-reasoning-walkthrough.md section shows exact Cypher queries you can run against the Neo4j graph.

Q: Is this data complete?

A: KGCS v1.0 is a frozen ontology. All relationships are published standards-backed. Incompleteness (missing CVEs, missing defenses) is a signal of gaps in the standards themselves, not data entry.

Next Steps

1. Pick a learning pathway (developer, researcher, or risk officer)
2. Read the case study most relevant to your role
3. Run the Cypher queries against the live Neo4j graph
4. Add your own case study using the template

References

• KGCS Ontology: Namespace Policy
• Agent Specs: Systems | Offensive | Defensive
• MITRE Standards: CAPEC | ATT&CK | D3FEND | CAR | SHIELD | ENGAGE
• NVD: CVE Search | CWE Search

Contributing

Found an issue? Want to add a case study? Have feedback?

1. Open an issue in the KGCS GitHub repository
2. Submit a PR with your case study
3. Follow the template structure

Last Updated: March 2026

KGCS Version: v1.0 (Frozen)

Graph Stats: 5.7M nodes | 27.5M edges | 13 node types | 13 relationship types