A Structured Workflow for Transforming Cyber Threat Intelligence into Computable Detection Patterns.

Abstract

Security Operations Centers (SOCs) routinely convert cyber threat intelligence (CTI) reports into operational detection content. A persistent bottleneck in this workflow is the translation of extracted indicators of compromise (IOCs) particularly file paths, registry keys, and command-line strings into deployable regular expressions (regexes) suitable for embedding in security information and event management (SIEM) correlation rules. Although prior work has improved automated indicator-of-compromise (IOC) extraction, transforming extracted strings into validated regex patterns remains largely manual, requires specialized expertise, and is prone to error. The goal of this protocol is to provide a standardized, reproducible procedure for IOC-to-regex translation. The workflow comprises five stages: (1) parsing heterogeneous CTI reports into a unified Markdown representation; (2) IOC extraction using multiple large language models (LLMs) with consensus voting; (3) rule-based normalization, categorization, and deduplication of extracted IOCs; (4) graph-assisted labeling of IOC components as keep (capture-group) or discard (non-capture-group); and (5) iterative regex generation with diagnostic validation against the original IOC strings. To assess utility, the workflow was applied to 3,156 CTI reports, and the resulting regexes were evaluated against more than 2,400 independently collected ground-truth strings from ten MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) Evaluation scenarios, yielding an average hit rate of 99.1 % and an average cross-IOC mismatch rate of 0.8 %. The protocol therefore documents a reproducible implementation for IOC-to-regex translation and explicitly delineates its current scope, operational assumptions, and known failure cases.