mlsanityData to 7 Oct 2026

EXTRACTOR: Extracting Attack Behavior from Threat Reports

arXiv 2104.08618 ↗First posted 17 Apr 2021cs.CR cs.AIcited by 19

Not on the map. Why?

Abstract (arXiv)

The knowledge on attacks contained in Cyber Threat Intelligence (CTI) reports is very important to effectively identify and quickly respond to cyber threats. However, this knowledge is often embedded in large amounts of text, and therefore difficult to use effectively. To address this challenge, we propose a novel approach and tool called EXTRACTOR that allows precise automatic extraction of concise attack behaviors from CTI reports. EXTRACTOR makes no strong assumptions about the text and is capable of extracting attack behaviors as provenance graphs from unstructured text. We evaluate EXTRACTOR using real-world incident reports from various sources as well as reports of DARPA adversarial engagements that involve several attack campaigns on various OS platforms of Windows, Linux, and FreeBSD. Our evaluation results show that EXTRACTOR can extract concise provenance graphs from CTI reports and show that these graphs can successfully be used by cyber-analytics tools in threat-hunting.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Builds on 8 of its 87 references that are in the map. First posted on arXiv 17 Apr 2021.

Builds on

8 of 87 references.

References · 8

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2018AllenNLP: A Deep Semantic Natural Language Processing Platformcited by 347
  3. 2019Simple BERT Models for Relation Extraction and Semantic Role Labelingcited by 154
  4. 2018Learning Named Entity Tagger using Domain-Specific Dictionarycited by 65
  5. 2018Anaphora and Coreference Resolution: A Reviewcited by 31
  6. 2018SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Datacited by 28
  7. 2019POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Huntingcited by 27
  8. 2014Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Datacited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 3; 2023: 1; 2024: 6; 2025: 3; 2026: 5.

19 papers.

Sort:

By area:

  1. 2022Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTIcited by 27
  2. 2023Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wildcited by 15
  3. 2021What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A surveycited by 14
  4. 2024CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Modelscited by 12
  5. 2022Automatic Mapping of Unstructured Cyber Threat Intelligence: An Experimental Studycited by 11
  6. 2025Large Language Models for Security Operations Centers: A Comprehensive Surveycited by 9
  7. 2024MoRSE: Bridging the Gap in Cybersecurity Expertise with Retrieval Augmented Generationcited by 8
  8. 2024AttacKG+:Boosting Attack Knowledge Graph Construction with Large Language Modelscited by 4
  9. 2025OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Promptingcited by 3
  10. 2024AI-Driven Cyber Threat Intelligence Automationcited by 2
  11. 2025False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systemscited by 2
  12. 2022Principled Data-Driven Decision Support for Cyber-Forensic Investigationscited by 1
7 more
  1. 2024Mining Temporal Attack Patterns from Cyberthreat Intelligence Reportscited by 1
  2. 2024PBP: Post-training Backdoor Purification for Malware Classifierscited by 1
  3. 2026Constructing Multi-label Hierarchical Classification Models for MITRE ATT&CK Text Taggingcited by 1
  4. 2026GRID: Graph Representation of Intelligence Data for Security Text Knowledge Graph Constructioncited by 1
  5. 2026TTPrint: Evidence-Grounded TTP Extraction via Diverge-then-Converge Verificationcited by 1
  6. 2026TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphscited by 1
  7. 2026CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligencecited by 0