Auto Threat AI: An Agentic and Explainable Framework for Automated Cyber Threat Intelligence Extraction

STINER: Automated Extraction of Strategic Cyber Threat Intelligence from X

Strategic Cyber Threat Intelligence (CTI) focuses on high-level insights, such as identifying targeted industries, attributing attacks to specific ransomware groups, and assessing the scale of data loss. Today, X (formerly Twitter) has become the fastest source for this intelligence, often hosting real-time breach announcements days before formal vendor reports. Converting this raw chatter into actionable intelligence requires navigating a complex linguistic landscape. Conventional Named Entity Recognition (NER) models struggle to parse the informal and highly irregular dialect of social media, creating a blind spot for automated defense systems. To address this challenge, we introduce STINER, a taxonomy and expert-annotated corpus for extracting strategic intelligence from social media streams. We construct a high-quality, expert-annotated dataset of 2,100 real-world alerts and propose a granular taxonomy of eight entity types centered on strategic pivots such as Threat Actor, Sector, and Location. We benchmark nine models across 12 evaluated configurations, spanning general-purpose and domain-adapted encoders, open-schema extraction, and generative LLMs in both zero-shot and fine-tuned settings. Domain-adapted encoders such as DarkBERT reach a strict F1-score of 89.33%, outperforming both general-purpose baselines and fine-tuned Large Language Models, which additionally incur substantially higher inference latency. Leveraging STINER-DarkBERT, we conduct a European threat landscape analysis for H1 2025. Our results align with official reporting on major targets while highlighting the distinct visibility profile of attacks in Spain, and illustrate how social-media-driven extraction can surface early signals of the SafePay ransomware campaign prior to its retrospective characterization in vendor threat landscape reports.

LLM Fine-Tuned Threat Intelligence Summarization Agent for CVE Report Automation

In this paper, an intelligent cyber threat intelligence framework involving automated vulnerability severity assessment, contextual risk interpretation and generation of mitigation recommendation is presented. The proposed system has been designed to analyze the CVE-related description of vulnerabilities and the security metadata related to them, classify the level of severity of the threat and estimate its relevance to risk with the help of a transformer-based natural language processing model. To build contextual awareness beyond classification, it adds a retrieval-augmented mechanism to recognize semantically similar vulnerability records for contextual evidence-based threat interpretation. It is additionally fortified with vulnerability analysis, like CVE retrieval, client qualifications, record following, and even visualisation as a web application platform. The two processes, one involving the severities of the transformers, and the other the retrieval of threat intelligence and mitigation advice, into a single operational flow, thus reducing the manual reliance on Vulnerability Triage and aiding security analysts in prioritizing cyber risks. The proposed framework allows for the automatic processing of textual information on vulnerabilities and the comparison of such information and a contextual analysis with previous vulnerabilities discovered. Unlike conventional vulnerability assessment approaches that perform severity classification independently of contextual threat interpretation, the proposed framework integrates transformer-based semantic analysis, retrieval-augmented vulnerability intelligence, cyber-risk estimation, and mitigation recommendation generation within a unified analytical workflow. By combining predictive language modelling with contextual vulnerability retrieval, the framework supports evidence-driven cyber threat analysis and structured decision support for security analysts. The proposed architecture provides a scalable approach for automated vulnerability prioritization and contextual cyber threat intelligence that is suitable for modern cybersecurity operations involving large volumes of vulnerability reports.

Artificial Intelligence-Based Insider-Threat Detection: A Hybrid Explainable Framework with Automated Response and Privilege Containment

Insider threats continue to be the most persistent and most destructive threat to cybersecurity; malicious or negligent users work only in the real-time restricted area of the organization and are gradually breaking the boundaries of company norms. Conventional rule-based and statistical detection methods have difficulty detecting inconspicuous, context-dependent, and ever-changing behavior, leading to detection delays and high false-positive rates. Our paper introduces an explainable AI-based Insider-Threat Detection (AIB-ITD) model that integrates enterprise telemetry—including email, web, logon/VPN, and file events—into a unified behavioral framework. The effectiveness of combining heterogeneous behavioral indicators observed in AIB-ITD is consistent with recent behavioral analytics implementations that have demonstrated the value of multimodal user-behavior profiling for insider-threat identification in enterprise environments. The proposed AIB-ITD framework is based on anomaly-driven processing, unsupervised models (Isolation Forest, PCA reconstruction, and Autoencoder) are combined with sequential modeling (with an LSTM Autoencoder) to model both static and temporal deviations in behavior. An ensemble strategy is applied to combine the outputs of these models to yield a probabilistic insider risk score. To improve transparent analysis and to help the analyst gain trust, SHapley Additive Explanations (SHAP) is used to keep every detection outcome transparent and interpretable using the features. It also integrates feature correlation analysis, static vs sequential-model comparisons, and SHAP stability assessment to validate methodological robustness and reproducibility. An experimental review of the hybrid ensemble using the SEI/CMU CERT Insider Threat Dataset reveals that it performs better than single models for anomaly detection and stability, especially with the inclusion of temporal patterns. The assessment prioritizes anomaly score consistency and reliable risk ranking, rather than classification accuracy, to better reflect real deployment scenarios. In addition, an Automated Response and Privilege Containment (ARPC) feature automatically converts risk scores to multilevel mitigation actions that serve to protect the privacy of the user as the least privileged policies are enforced promptly. The proposed model showed superior robustness, stability, and operational effectiveness to classical methods, especially in the presence of scarce labeled data. Through hybrid anomaly recognition, explainable AI and automated response, AIB-ITD is a practical and scalable solution for next-generation insider-threat detection in enterprise systems.

A Structured Workflow for Transforming Cyber Threat Intelligence into Computable Detection Patterns.

Security Operations Centers (SOCs) routinely convert cyber threat intelligence (CTI) reports into operational detection content. A persistent bottleneck in this workflow is the translation of extracted indicators of compromise (IOCs) particularly file paths, registry keys, and command-line strings into deployable regular expressions (regexes) suitable for embedding in security information and event management (SIEM) correlation rules. Although prior work has improved automated indicator-of-compromise (IOC) extraction, transforming extracted strings into validated regex patterns remains largely manual, requires specialized expertise, and is prone to error. The goal of this protocol is to provide a standardized, reproducible procedure for IOC-to-regex translation. The workflow comprises five stages: (1) parsing heterogeneous CTI reports into a unified Markdown representation; (2) IOC extraction using multiple large language models (LLMs) with consensus voting; (3) rule-based normalization, categorization, and deduplication of extracted IOCs; (4) graph-assisted labeling of IOC components as keep (capture-group) or discard (non-capture-group); and (5) iterative regex generation with diagnostic validation against the original IOC strings. To assess utility, the workflow was applied to 3,156 CTI reports, and the resulting regexes were evaluated against more than 2,400 independently collected ground-truth strings from ten MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) Evaluation scenarios, yielding an average hit rate of 99.1 % and an average cross-IOC mismatch rate of 0.8 %. The protocol therefore documents a reproducible implementation for IOC-to-regex translation and explicitly delineates its current scope, operational assumptions, and known failure cases.

An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

Evolving Cyber Threat Intelligence: A Systematic Review and Comparative Analysis

To improve cybersecurity across industries, Cyber Threat Intelligence (CTI) is becoming increasingly crucial. This systematic review explores how CTI practices are evolving in response to advancements in Artificial Intelligence (AI), particularly in the context of Large Language Models (LLMs). We examined 61 peer-reviewed studies using the PRISMA methodology, which demonstrates a strict selection procedure founded on specified inclusion, exclusion, and quality standards. This approach aligns with the scope of similar systematic reviews in the field of cyber threat intelligence. The review provides a comparative synthesis of CTI research capabilities across threat detection and prediction, attribution, forecasting, and automated reporting. We classify these approaches into three categories: conventional methods, those enhanced by AI and Machine Learning, and those based on LLMs. Our findings indicate that LLMs offer significant advantages in contextual reasoning, processing unstructured threat intelligence, and generating actionable mitigation plans. However, challenges such as model explainability, data privacy, system interoperability, and standardization impede their integration into operational environments. In addition to highlighting the potential and practical limitations of LLMs in CTI, this study identifies research gaps and proposes methods to create scalable, secure, and flexible CTI systems that support real-time cyber defense.