# EXTRACTOR: Extracting Attack Behavior from Threat Reports

arXiv: https://arxiv.org/abs/2104.08618 · HTML: https://mlsanity.com/paper/2104.08618/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 87 references that are in the map.
- First posted on arXiv 17 Apr 2021.

## Builds on (most cited first, 8 of 8)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [AllenNLP: A Deep Semantic Natural Language Processing Platform](https://mlsanity.com/paper/1803.07640/) (2018)
- [Simple BERT Models for Relation Extraction and Semantic Role Labeling](https://mlsanity.com/paper/1904.05255/) (2019)
- [Learning Named Entity Tagger using Domain-Specific Dictionary](https://mlsanity.com/paper/1809.03599/) (2018)
- [Anaphora and Coreference Resolution: A Review](https://mlsanity.com/paper/1805.11824/) (2018)
- [SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data](https://mlsanity.com/paper/1801.02062/) (2018)
- [POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting](https://mlsanity.com/paper/1910.00056/) (2019)
- [Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data](https://mlsanity.com/paper/1411.5005/) (2014)

## Built on by (most cited first, 19 of 19)

- [Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI](https://mlsanity.com/paper/2211.01753/) (2022)
- [Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild](https://mlsanity.com/paper/2307.10214/) (2023)
- [What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey](https://mlsanity.com/paper/2109.06808/) (2021)
- [CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Models](https://mlsanity.com/paper/2410.21060/) (2024)
- [Automatic Mapping of Unstructured Cyber Threat Intelligence: An Experimental Study](https://mlsanity.com/paper/2208.12144/) (2022)
- [Large Language Models for Security Operations Centers: A Comprehensive Survey](https://mlsanity.com/paper/2509.10858/) (2025)
- [MoRSE: Bridging the Gap in Cybersecurity Expertise with Retrieval Augmented Generation](https://mlsanity.com/paper/2407.15748/) (2024)
- [AttacKG+:Boosting Attack Knowledge Graph Construction with Large Language Models](https://mlsanity.com/paper/2405.04753/) (2024)
- [OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Prompting](https://mlsanity.com/paper/2503.03108/) (2025)
- [Mining Temporal Attack Patterns from Cyberthreat Intelligence Reports](https://mlsanity.com/paper/2401.01883/) (2024)
- [AI-Driven Cyber Threat Intelligence Automation](https://mlsanity.com/paper/2410.20287/) (2024)
- [PBP: Post-training Backdoor Purification for Malware Classifiers](https://mlsanity.com/paper/2412.03441/) (2024)
- [False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systems](https://mlsanity.com/paper/2507.06252/) (2025)
- [CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence](https://mlsanity.com/paper/2608.18613/) (2026)
- [Principled Data-Driven Decision Support for Cyber-Forensic Investigations](https://mlsanity.com/paper/2211.13345/) (2022)
- [Constructing Multi-label Hierarchical Classification Models for MITRE ATT&CK Text Tagging](https://mlsanity.com/paper/2601.14556/) (2026)
- [GRID: Graph Representation of Intelligence Data for Security Text Knowledge Graph Construction](https://mlsanity.com/paper/2605.16714/) (2026)
- [CTI2TTP: Evidence-Grounded TTP Extraction from Cyber Threat Intelligence via Diverge-then-Converge Verification](https://mlsanity.com/paper/2605.25836/) (2026)
- [TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs](https://mlsanity.com/paper/2607.24563/) (2026)

## Abstract (arXiv)

The knowledge on attacks contained in Cyber Threat Intelligence (CTI) reports is very important to effectively identify and quickly respond to cyber threats. However, this knowledge is often embedded in large amounts of text, and therefore difficult to use effectively. To address this challenge, we propose a novel approach and tool called EXTRACTOR that allows precise automatic extraction of concise attack behaviors from CTI reports. EXTRACTOR makes no strong assumptions about the text and is capable of extracting attack behaviors as provenance graphs from unstructured text. We evaluate EXTRACTOR using real-world incident reports from various sources as well as reports of DARPA adversarial engagements that involve several attack campaigns on various OS platforms of Windows, Linux, and FreeBSD. Our evaluation results show that EXTRACTOR can extract concise provenance graphs from CTI reports and show that these graphs can successfully be used by cyber-analytics tools in threat-hunting.