mlsanityData to 7 Oct 2026

What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey

arXiv 2109.06808 ↗First posted 14 Sep 2021cs.CR cs.CL cs.LGcited by 14

Not on the map. Why?

Abstract (arXiv)

Cybersecurity researchers have contributed to the automated extraction of CTI from textual sources, such as threat reports and online articles, where cyberattack strategies, procedures, and tools are described. The goal of this article is to aid cybersecurity researchers understand the current techniques used for cyberthreat intelligence extraction from text through a survey of relevant studies in the literature. We systematically collect "CTI extraction from text"-related studies from the literature and categorize the CTI extraction purposes. We propose a CTI extraction pipeline abstracted from these studies. We identify the data sources, techniques, and CTI sharing formats utilized in the context of the proposed pipeline. Our work finds ten types of extraction purposes, such as extraction indicators of compromise extraction, TTPs (tactics, techniques, procedures of attack), and cybersecurity keywords. We also identify seven types of textual sources for CTI extraction, and textual data obtained from hacker forums, threat reports, social media posts, and online news articles have been used by almost 90% of the studies. Natural language processing along with both supervised and unsupervised machine learning techniques such as named entity recognition, topic modelling, dependency parsing, supervised classification, and clustering are used for CTI extraction. We observe the technical challenges associated with these studies related to obtaining available clean, labelled data which could assure replication, validation, and further extension of the studies. As we find the studies focusing on CTI information extraction from text, we advocate for building upon the current CTI extraction work to help cybersecurity practitioners with proactive decision making such as threat prioritization, automated threat modelling to utilize knowledge from past cybersecurity incidents.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Builds on 16 of its 201 references that are in the map. First posted on arXiv 14 Sep 2021.

Builds on

16 of 201 references.

References · 16

  1. 2013Efficient Estimation of Word Representations in Vector Spacecited by 4,346
  2. 2017Graph Embedding Techniques, Applications, and Performance: A Surveycited by 188
  3. 2021EXTRACTOR: Extracting Attack Behavior from Threat Reportscited by 19
  4. 2013Automatic Labeling for Entity Extraction in Cyber Securitycited by 13
  5. 2019Processing Tweets for Cybersecurity Threat Awarenesscited by 10
  6. 2015Towards a relation extraction framework for cyber-security conceptscited by 9
  7. 2016Darknet and Deepnet Mining for Proactive Cybersecurity Threat Intelligencecited by 8
  8. 2018Early Warnings of Cyber Threats in Online Discussionscited by 8
  9. 2017Crowdsourcing Cybersecurity: Cyber Attack Detection using Social Mediacited by 6
  10. 2017FAST2: an Intelligent Assistant for Finding Relevant Paperscited by 6
  11. 2018Mining Threat Intelligence about Open-Source Projects and Libraries from Code Repository Issues and Bug Reportscited by 6
  12. 2019Cyberthreat Detection from Twitter using Deep Neural Networkscited by 6
4 more
  1. 2019A Novel Approach for Detection and Ranking of Trendy and Emerging Cyber Threat Events in Twitter Streamscited by 5
  2. 2019Gathering Cyber Threat Intelligence from Twitter Using Novelty Classificationcited by 3
  3. 2019Collecting Indicators of Compromise from Unstructured Text of Cybersecurity Articles using Neural-Based Sequence Labellingcited by 2
  4. 2021Social Media Monitoring for IoT Cyber-Threatscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 2; 2024: 4; 2025: 4; 2026: 3.

14 papers.

Sort:

By area:

  1. 2024LLMCloudHunter: Harnessing LLMs for Automated Extraction of Detection Rules from Cloud-Based CTIcited by 17
  2. 2024CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Modelscited by 12
  3. 2023HW-V2W-Map: Hardware Vulnerability to Weakness Mapping Framework for Root Cause Analysis with GPT-assisted Mitigation Suggestioncited by 8
  4. 2022From Threat Reports to Continuous Threat Intelligence: A Comparison of Attack Technique Extraction Methods from Textual Artifactscited by 3
  5. 2023Cream Skimming the Underground: Identifying Relevant Information Points from Online Forumscited by 2
  6. 2024AnnoCTR: A Dataset for Detecting and Linking Entities, Tactics, and Techniques in Cyber Threat Reportscited by 2
  7. 2025False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systemscited by 2
  8. 2024Mining Temporal Attack Patterns from Cyberthreat Intelligence Reportscited by 1
  9. 2025EventHunter: Dynamic Clustering and Ranking of Security Events from Hacker Forum Discussionscited by 1
  10. 2026Evaluating Open-Source LLMs for Multi-Label ATT&CK Technique Classification on CTI Reportscited by 1
  11. 2025CTI Dataset Construction from Telegramcited by 0
  12. 2025From Retrieval to Reasoning: A Framework for Cyber Threat Intelligence NER with Explicit and Adaptive Instructionscited by 0
2 more
  1. 2026Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilitiescited by 0
  2. 2026Ranked by the Matcher: A Reproducibility Audit of Knowledge Graph Extraction from Threat Reportscited by 0