mlsanityData to 14 Oct 2026

Automatic Mapping of Unstructured Cyber Threat Intelligence: An Experimental Study

arXiv 2208.12144 ↗First posted 25 Aug 2022cs.CR cs.CL cs.LGcited by 11

Not on the map. Why?

Abstract (arXiv)

Proactive approaches to security, such as adversary emulation, leverage information about threat actors and their techniques (Cyber Threat Intelligence, CTI). However, most CTI still comes in unstructured forms (i.e., natural language), such as incident reports and leaked documents. To support proactive security efforts, we present an experimental study on the automatic classification of unstructured CTI into attack techniques using machine learning (ML). We contribute with two new datasets for CTI analysis, and we evaluate several ML models, including both traditional and deep learning-based ones. We present several lessons learned about how ML can perform at this task, which classifiers perform best and under which conditions, which are the main causes of classification errors, and the challenges ahead for CTI analysis.

Key facts. Cited by 11 papers in the map (data through 14 Oct 2026). Builds on 6 of its 44 references that are in the map. First posted on arXiv 25 Aug 2022.

Builds on

6 of 44 references.

References · 6

  1. 2017Attention Is All You Needcited by 60,361
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  3. 2020Metrics for Multi-Class Classification: an Overviewcited by 143
  4. 2021EXTRACTOR: Extracting Attack Behavior from Threat Reportscited by 19
  5. 2021Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approachcited by 9
  6. 2020SoK: A Survey of Open-Source Threat Emulatorscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 3; 2024: 4; 2025: 1; 2026: 3.

11 papers.

  1. 2023Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wildcited by 15
  2. 2023On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptionscited by 11
  3. 2023Advancing TTP Analysis: Harnessing the Power of Large Language Models with Retrieval Augmented Generationcited by 8
  4. 2024Enterprise Benchmarks for Large Language Model Evaluationcited by 5
  5. 2024Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognitioncited by 4
  6. 2024On the use of neurosymbolic AI for defending against cyber attackscited by 3
  7. 2024Mining Temporal Attack Patterns from Cyberthreat Intelligence Reportscited by 2
  8. 2026TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphscited by 1
  9. 2025CTIGuardian: A Few-Shot Framework for Mitigating Privacy Leakage in Fine-Tuned LLMscited by 0
  10. 2026Characterizing Resource Sharing Practices on Underground Internet Forum Synthetic Non-Consensual Intimate Image Content Creation Communitiescited by 0
  11. 2026GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attackscited by 0