Aug 2026· International journal of computer information systems and industrial management applications· Vol 18, pp. 726-738· 0 citations
TL;DR
This paper offers an automated solution to the problem of categorizing the threat descriptions based on OSINT into the MITRE ATT&CK techniques with a sophisticated model based on transformer and natural language processing, leading to more effective CTI automation and decision support to the security operations of a practitioner.
Abstract
Open-Source Intelligence (OSINT) can be considered a crucial part of the present-day Cyber Threat Intelligence (CTI) due to delivering prompt information about the adversary activity using publicly accessible reporting and analysis. Nonetheless, the conversion of unstructured OSINT stories into structured forms like the MITRE ATT&CK model is a highly manual and subjective task. The proposed paper offers an automated solution to the problem of categorizing the threat descriptions based on OSINT into the MITRE ATT&CK techniques with a sophisticated model based on transformer and natural language processing. The suggested framework has combined OSINT preprocessing, threat behavior extraction, semantic representation learning and multi-label ATT&CK techniques classification with confidence-aware outputs. Large-scale experiments on a wide OSINT corpus show that the proposed method is far more effective compared to the ones that rely on keyword parameters and conventional machine learning baselines, especially when there are missing and imprecise threat specifications. Findings indicate greater accuracy, retrieval, and strength of a vast variety of ATT&CK methods, including categories of low density. This work is a step in the right direction by facilitating scalable and standardized ATT&CK mapping of noisy OSINT data, thus leading to more effective CTI automation and decision support to the security operations of a practitioner.
An algorithm is developed that automates and streamlines the analysis of equipment field-failure reports and other unstructured maintenance records and reduces the resource-intensive manual work required to prepare, interpret, and process FRACAS reports, thus enabling timelier, data-driven equipment reliability analysis.
Esther Yu, Guangjiang Cao, Y. Khalil et al.· Journal of Research in Engin...· 0 citations
Fake news detection has become a major research topic at the intersection of artificial intelligence, data mining, and information security. In this paper, we evaluate the performance of English-trained algorithms on English translations of Romanian-sourced news articles, using a translation-mediated cross-domain evaluation design. The study is based on source code generated with the assistance of artificial intelligence systems for a set of machine learning and transformer-based models. The code was subsequently implemented in Google Colab. 2026, trained on international benchmark datasets, and tested on Romanian news content. This design allowed the rapid prototyping of multiple detection pipelines and the systematic observation of their behavior in a media environment different from that represented in the training corpora. The models were evaluated comparatively using standard classification metrics, including accuracy, precision, recall, and F1-score, complemented by additional indicators relevant to model robustness and practical usability. The experimental results revealed significant differences in performance across algorithms when applied to English translations of Romanian-language news content after training on international datasets. However, this study does not provide a direct comparison between model performance on the international benchmark datasets and the Romanian test corpus; therefore, the gap between the international training corpus and the Romanian-sourced test corpus is interpreted as an exploratory limitation and as a direction for future research. Based on these findings, we propose an empirical classification of the tested models according to their predictive effectiveness, their contextual robustness across linguistic environments, and their operational relevance as filtering tools for institutional monitoring. The results show that AI-assisted coding workflows can provide a viable starting point for reproducible misinformation research, but they also underline the limitations of directly transferring models trained on non-Romanian data to local media ecosystems. The study offers both a replicable evaluation framework and practical insights for institutions involved in strategic communication, public security, and the monitoring of information threats.
C. Coman, Costel Marian Dalban, Vlad Bătrânu-Pințea et al.· Information· 0 citations
Phishing remains one of the most persistent cyber threats, particularly in email environments where deceptive messages can be distributed at scale. This paper compares five classifiers: Multinomial Naive Bayes, Random Forest, Bidirectional Long Short-Term Memory (BiLSTM), DistilBERT, and BERT-base. A multi-source corpus of 82,689 cleaned and deduplicated emails was built from nine public datasets. Under a unified protocol, BERT-base achieved the highest F1-score (0.9824), while DistilBERT obtained an almost identical F1-score (0.9822) with lower measured inference latency (1.130 versus 2.218 ms/email), representing the strongest accuracy–latency trade-off in the evaluated environment. LIME explanations exposed plausible phishing indicators, such as urgency and account-verification language, but also mixed local contributions that require cautious interpretation. In the source-held-out experiment, the positive-class prevalence changed from 41.1% in training to 26.6% in testing, and DistilBERT produced 505 false negatives but only two false positives. Consequently, recall decreased from 0.9750 to 0.5346, showing that high mixed-source test performance does not guarantee robustness when complete data sources are unseen.
Andre Sebastian Samaniego Buñay, Ariel Misael Orellana Albarracin, Joel Marcelo Chuquimarca Pomagualli· Enfoque UTE· 0 citations
The threat posed by adversarial prompts to large language models is becoming harder to ignore. Problems including prompt injection, jailbreaking, phishing, and Unicode-based attacks are now widespread. Most existing solutions protect against only one threat type, operate in English only, and provide no explanation for their decisions. We present SemGuard, a multilingual security gateway using Triple-Anchor Semantic Threat Modeling, which simultaneously evaluates each input against three semantic reference sets: attack, safe, and destructive. SemGuard detects four threat types concurrently in Arabic, Arabizi, and English. We expand the original Arabic Security Dataset from 319 to 807 validated examples across seven threat categories, using three independent LLM judges (GPT-4o, Grok-4, Llama 3.3 70B) achieving Fleiss' $\kappa=0.839$. After retraining on the expanded dataset, SemGuard achieves a mean F1-score of 0.989 and recall of 0.991, representing a 13.7% improvement over the original implementation. Analysis of 527 rejected examples reveals quantitative evidence of threat-category ambiguity, with impersonation exhibiting a 98.2% inter-judge disagreement rate, validating the necessity of the Triple-Anchor framework. This work also presents the first Arabic LLM security dataset with a formal LLM-as-Judge annotation protocol.
Abdullah M. Abughallous, Somia Abufakher· IEEE Jordan Conference on Ap...· 0 citations
Mapping cyber threat intelligence (CTI) text to MITRE ATT&CK techniques is essential for structured threat analysis, yet manual annotation is costly and does not scale. The ATT&CK taxonomy comprises several hundred attack techniques, and a single CTI passage may describe multiple techniques, making accurate and complete extraction challenging. Existing automated approaches fall short in different ways: multi-label classifiers struggle with severe class imbalance and the large label space, while LLM-based methods--retrieval pipelines and fine-tuned generators--optimize token-level objectives that treat technique annotation as sequence generation rather than set prediction, lacking direct supervision on whether the predicted technique set is correct and complete. We propose TTP-R1, a two-stage framework that combines retrieval-augmented supervised fine-tuning (SFT) with reinforcement learning using verifiable rewards (RLVR). A hybrid retriever first narrows the large label space to a candidate set, and a fine-tuned LLM learns to select the correct techniques. We then apply Group Relative Policy Optimization with a decomposed reward that directly supervises the precision, recall, and output format of the predicted technique set. Across four CTI benchmarks, TTP-R1 achieves the best average F1, improving sub-technique-level F1 by 7.4 percentage points over Claude Sonnet 4.5 with retrieval augmentation, while running 28x faster when served as an 8B-parameter model on a single GPU.
Jiayun Zhang, Junshen Xu, Zejun Xie et al.· 0 citations
Fake review detection in low-resource and code-mixed languages remains challenging due to informal writing styles, transliterated regional expressions, linguistic variability, and the limited availability of annotated datasets. This paper presents a hybrid LaBSE semantic and handcrafted feature fusion approach with machine learning for fake review detection in Roman Marathi code-mixed text. A real-time dataset comprising 2,287 Roman Marathi reviews collected from multiple online platforms is utilized to evaluate the proposed approach. The framework integrates opinion-mining features with multilingual semantic representations generated using Language-agnostic BERT Sentence Embedding (LaBSE) and handcrafted linguistic, behavioural, contextual, temporal, and metadata features to construct a comprehensive hybrid feature representation. The dataset is balanced using random oversampling and subsequently partitioned into training and testing subsets using an 80:20 ratio. Four machine learning classifiers, namely Random Forest, XGBoost, Support Vector Machine, and K-Nearest Neighbour, are evaluated using accuracy, precision, recall, and F1-score. Experimental results demonstrate that XGBoost achieves the best performance with 94.60% accuracy, 95.63% precision, 93.47% recall, and 94.54% F1-score, outperforming the other evaluated classifiers. The findings demonstrate the effectiveness of combining multilingual semantic information with explicit linguistic and contextual characteristics for identifying deceptive reviews in Roman Marathi code-mixed environments and establish an initial benchmark for fake review detection in this low-resource setting.
Swapnil S. Nehar, R. Keole, Pravin P. Karde· International journal of com...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
