# What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey

arXiv: https://arxiv.org/abs/2109.06808 · HTML: https://mlsanity.com/paper/2109.06808/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 201 references that are in the map.
- First posted on arXiv 14 Sep 2021.

## Builds on (most cited first, 16 of 16)

- [Efficient Estimation of Word Representations in Vector Space](https://mlsanity.com/paper/1301.3781/) (2013)
- [Graph Embedding Techniques, Applications, and Performance: A Survey](https://mlsanity.com/paper/1705.02801/) (2017)
- [EXTRACTOR: Extracting Attack Behavior from Threat Reports](https://mlsanity.com/paper/2104.08618/) (2021)
- [Automatic Labeling for Entity Extraction in Cyber Security](https://mlsanity.com/paper/1308.4941/) (2013)
- [Processing Tweets for Cybersecurity Threat Awareness](https://mlsanity.com/paper/1904.02072/) (2019)
- [Towards a relation extraction framework for cyber-security concepts](https://mlsanity.com/paper/1504.04317/) (2015)
- [Darknet and Deepnet Mining for Proactive Cybersecurity Threat Intelligence](https://mlsanity.com/paper/1607.08583/) (2016)
- [Early Warnings of Cyber Threats in Online Discussions](https://mlsanity.com/paper/1801.09781/) (2018)
- [Crowdsourcing Cybersecurity: Cyber Attack Detection using Social Media](https://mlsanity.com/paper/1702.07745/) (2017)
- [FAST2: an Intelligent Assistant for Finding Relevant Papers](https://mlsanity.com/paper/1705.05420/) (2017)
- [Mining Threat Intelligence about Open-Source Projects and Libraries from Code Repository Issues and Bug Reports](https://mlsanity.com/paper/1808.04673/) (2018)
- [Cyberthreat Detection from Twitter using Deep Neural Networks](https://mlsanity.com/paper/1904.01127/) (2019)
- [A Novel Approach for Detection and Ranking of Trendy and Emerging Cyber Threat Events in Twitter Streams](https://mlsanity.com/paper/1907.07768/) (2019)
- [Gathering Cyber Threat Intelligence from Twitter Using Novelty Classification](https://mlsanity.com/paper/1907.01755/) (2019)
- [Collecting Indicators of Compromise from Unstructured Text of Cybersecurity Articles using Neural-Based Sequence Labelling](https://mlsanity.com/paper/1907.02636/) (2019)
- [Social Media Monitoring for IoT Cyber-Threats](https://mlsanity.com/paper/2109.04306/) (2021)

## Built on by (most cited first, 14 of 14)

- [LLMCloudHunter: Harnessing LLMs for Automated Extraction of Detection Rules from Cloud-Based CTI](https://mlsanity.com/paper/2407.05194/) (2024)
- [CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Models](https://mlsanity.com/paper/2410.21060/) (2024)
- [HW-V2W-Map: Hardware Vulnerability to Weakness Mapping Framework for Root Cause Analysis with GPT-assisted Mitigation Suggestion](https://mlsanity.com/paper/2312.13530/) (2023)
- [From Threat Reports to Continuous Threat Intelligence: A Comparison of Attack Technique Extraction Methods from Textual Artifacts](https://mlsanity.com/paper/2210.02601/) (2022)
- [Cream Skimming the Underground: Identifying Relevant Information Points from Online Forums](https://mlsanity.com/paper/2308.02581/) (2023)
- [Mining Temporal Attack Patterns from Cyberthreat Intelligence Reports](https://mlsanity.com/paper/2401.01883/) (2024)
- [AnnoCTR: A Dataset for Detecting and Linking Entities, Tactics, and Techniques in Cyber Threat Reports](https://mlsanity.com/paper/2404.07765/) (2024)
- [False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systems](https://mlsanity.com/paper/2507.06252/) (2025)
- [EventHunter: Dynamic Clustering and Ranking of Security Events from Hacker Forum Discussions](https://mlsanity.com/paper/2507.09762/) (2025)
- [Evaluating Open-Source LLMs for Multi-Label ATT&CK Technique Classification on CTI Reports](https://mlsanity.com/paper/2606.18166/) (2026)
- [CTI Dataset Construction from Telegram](https://mlsanity.com/paper/2509.20943/) (2025)
- [From Retrieval to Reasoning: A Framework for Cyber Threat Intelligence NER with Explicit and Adaptive Instructions](https://mlsanity.com/paper/2512.19414/) (2025)
- [Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilities](https://mlsanity.com/paper/2607.16175/) (2026)
- [Ranked by the Matcher: A Reproducibility Audit of Knowledge Graph Extraction from Threat Reports](https://mlsanity.com/paper/2609.01671/) (2026)

## Abstract (arXiv)

Cybersecurity researchers have contributed to the automated extraction of CTI from textual sources, such as threat reports and online articles, where cyberattack strategies, procedures, and tools are described. The goal of this article is to aid cybersecurity researchers understand the current techniques used for cyberthreat intelligence extraction from text through a survey of relevant studies in the literature. We systematically collect "CTI extraction from text"-related studies from the literature and categorize the CTI extraction purposes. We propose a CTI extraction pipeline abstracted from these studies. We identify the data sources, techniques, and CTI sharing formats utilized in the context of the proposed pipeline. Our work finds ten types of extraction purposes, such as extraction indicators of compromise extraction, TTPs (tactics, techniques, procedures of attack), and cybersecurity keywords. We also identify seven types of textual sources for CTI extraction, and textual data obtained from hacker forums, threat reports, social media posts, and online news articles have been used by almost 90% of the studies. Natural language processing along with both supervised and unsupervised machine learning techniques such as named entity recognition, topic modelling, dependency parsing, supervised classification, and clustering are used for CTI extraction. We observe the technical challenges associated with these studies related to obtaining available clean, labelled data which could assure replication, validation, and further extension of the studies. As we find the studies focusing on CTI information extraction from text, we advocate for building upon the current CTI extraction work to help cybersecurity practitioners with proactive decision making such as threat prioritization, automated threat modelling to utilize knowledge from past cybersecurity incidents.