Aug 2026· International journal of computer information systems and industrial management applications· 0 citations
TL;DR
CyberNER is introduced, a two-stage pipeline to solve the multi-type NER and alias canonicalization problem in APT CTI reports and achieves a Macro-F1 score of 0.853, outperforming all four baselines.
Abstract
APT reports in the Cyber Threat Intelligence (CTI) are rich with information, but are not structured, resulting in security analysts devoting 2-3 hours to manually sifting through each report to identify the linkages, tactics, techniques, and relationships. Named Entity Recognition (NER) systems aim to overcome the manual nature of this task, but existing solutions result in limited entity coverage, boundary false negatives caused by the rigid fixed-window tokenization, and failure to resolve conflicting vendor aliases. Therefore, this paper introduces CyberNER, a two-stage pipeline to solve the multi-type NER and alias canonicalization problem in APT CTI reports. In Stage 1, Documents through semantic hierarchical chunking are categorised at natural section, paragraph, and sentence boundaries. Stage 2 would introduce fine-tuned CySecBERT, a cybersecurity language model based on CySecBERT, to identify 12 types. Each entity has a confidence score. There is also a three-tier MITRE STIX 2.1 alias canonicalization layer that addresses variations in surface forms from different vendor reports. The Threat Recall Actor improves exponentially from a baseline of 21% to 94%. Evaluated using a 12-type annotated benchmark from 182 APTNotes reports covering 30 APT groups, CyberNER achieves a Macro-F1 score of 0.853, outperforming all four baselines. The structured JSON output is directly consumable for downstream tasks, including TTP mapping, attack-flow graph generation, and multi-source intelligence fusion.
STINER, a taxonomy and expert-annotated corpus for extracting strategic intelligence from social media streams is introduced, and how social-media-driven extraction can surface early signals of the SafePay ransomware campaign prior to its retrospective characterization in vendor threat landscape reports is illustrated.
Yasir Ech-Chammakhy, Oussama Azrara, J. Chbili et al.· 0 citations
Automated parsing of Cyber Threat Intelligence (CTI) is crucial for threat attribution and proactive defense. However, Chinese CTI texts are highly unstructured and semantically fragmented, posing dual challenges for existing models. In entity extraction, fragmented tokenization caused by high-entropy entities and complex nested structures leads to ambiguous entity boundaries. In relation extraction, critical attack clues are scattered across paragraphs, preventing traditional attention mechanisms from effectively capturing long-range dependencies and relative spatial structures. To address these limitations, we propose an adaptive global-local joint extraction framework designed for fragmented semantic aggregation in Chinese CTI. Within the entity recognition module, we introduce adaptive rotary position embeddings to correct low-level positional features. This mechanism, combined with a type-decoupled GlobalPointer, resolves recognition conflicts involving long-span entities and nested boundaries. In the relation extraction module, we design a dual-stage attention mechanism to dynamically integrate global cross-paragraph spatial clues with local entity neighborhood features. Additionally, an adaptive decoding strategy aware of class imbalance is implemented to enhance the robustness of the model against sparse long-tail relations. Experimental results on the CDTier dataset indicate that the proposed framework achieves a 9.45% improvement in the F1 score of entity extraction over the best existing baseline, alongside a precision of 93.3% and a recall of 95.5% for relation extraction. The proposed method overcomes the bottleneck of long-range semantic parsing in complex Chinese contexts, demonstrating superior generalization capabilities and practical utility.
Jipeng Tang· Poster Volume 0008 The 2026...· 0 citations
Automated extraction of structured threat information from unstructured cyber threat intelligence (CTI) underpins modern security operations, yet the supporting machine learning resources are almost exclusively English: no annotated Arabic CTI named entity recognition (NER) corpus has been published. We introduce AraCTI-NER, a dataset of 10,312 token-level annotated samples (275,530 tokens; 42,360 entity spans) over eight STIX-inspired entity types, built by an LLM-assisted pipeline seeded with authentic Arabic cybersecurity articles, structurally validated and rebalanced through targeted generation. We benchmark seven encoders from three families (Arabic-specialized, English cybersecurity-adapted, and multilingual) over three seeds under strict entity-level metrics, and release a 408-sentence expert-audited test subset (ATS-gold) whose reliability is quantified by a second independent expert validation (inter-annotator agreement 0.878 entity-level F1). XLM-RoBERTa Large attains the best mean F1 (0.7603; 0.7674 on ATS-gold), with AraBERTv2 close behind (0.7491), while both English-only cybersecurity encoders fall to ≈0.63, a separation that holds across every seed and survives expert correction, with the ≈3-point F1 decrease from ATS-silver to ATS-gold concentrated in Vulnerability and TTP. On 350 doubly annotated sentences from authentic Arabic cyber-incident news, a shift in both provenance and register, the strongest model reaches F1 = 0.5429 against an inter-annotator F1 of 0.616. AraCTI-NER establishes the first reproducible baseline for Arabic CTI NER and identifies domain-adaptive Arabic cybersecurity pre-training as the highest-value next step.
Graph2TTP is proposed, a novel neural-symbolic framework for automated, paragraph-level Tactic, Technique and Procedure (TTP) identification that outperforms state-of-the-art neural baselines and establishes a robust new standard for accurate and interpretable threat intelligence analysis.
Patrick Zounon, Yu-Fei Han, Michel Hurfin et al.· International Conference on...· 0 citations
A manually constructed dataset of 150 English-language CTI reports, each represented as STIX 2.1 based graphs, provides a benchmark for CTI information extraction, knowledge-graph construction, incident analysis, and threat attribution and indicates that locally deployed LLMs can support human reviewers in identifying annotation inconsistencies, but expert validation remains essential.
Dipshikha Das, Arnab Banik, Md. Shariful Islam et al.· arXiv.org· 0 citations
Cyber Threat Intelligence (CTI) enables Security Operations Centers (SOCs) to understand adversary behavior,
prioritize risks, and respond to cyber threats. However, cur-rent CTI workflows still depend heavily on manual analysis
of unstructured threat reports, vulnerability advisories, open-source intelligence, social media posts, and structured feeds. This
creates operational latency, inconsistent extraction quality, weak provenance, and limited scalability. This paper presents Auto
Threat AI, an agentic and explainable framework for automated CTI extraction, correlation, scoring, and analyst-governed SOC
operationalization. The proposed framework integrates determin-istic indicator extraction, Natural Language Processing (NLP),
schema-guided Large Language Model (LLM) agents, graph-aware threat correlation, bounded risk scoring, evidence-first
explainability, and Human-in-the-Loop (HITL) governance. The system ingests heterogeneous CTI sources, extracts entities and
relations such as IOCs, CVEs, malware, campaigns, threat actors, tools, and techniques, constructs a threat knowledge graph,
gen-erates campaign candidates, and presents risk-ranked intelligence through a SOC dashboard. Experimental evaluation on
safe demonstration CTI data shows that the implemented prototype ingested 6 sources, extracted 36 entities, generated 33
relations, detected 11 threat events, identified 5 campaign candidates, and routed 8 items for HITL review. The results
demonstrate that Auto Threat AI can reduce manual CTI processing effort while improving traceability, explainability, and
analyst trust.
Methari Keeravani· International Journal for Re...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
