# Automatic Mapping of Unstructured Cyber Threat Intelligence: An Experimental Study

arXiv: https://arxiv.org/abs/2208.12144 · HTML: https://mlsanity.com/paper/2208.12144/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 44 references that are in the map.
- First posted on arXiv 25 Aug 2022.

## Builds on (most cited first, 6 of 6)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Metrics for Multi-Class Classification: an Overview](https://mlsanity.com/paper/2008.05756/) (2020)
- [EXTRACTOR: Extracting Attack Behavior from Threat Reports](https://mlsanity.com/paper/2104.08618/) (2021)
- [Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approach](https://mlsanity.com/paper/2108.01696/) (2021)
- [SoK: A Survey of Open-Source Threat Emulators](https://mlsanity.com/paper/2003.01518/) (2020)

## Built on by (most cited first, 11 of 11)

- [Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild](https://mlsanity.com/paper/2307.10214/) (2023)
- [On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptions](https://mlsanity.com/paper/2306.14062/) (2023)
- [Advancing TTP Analysis: Harnessing the Power of Large Language Models with Retrieval Augmented Generation](https://mlsanity.com/paper/2401.00280/) (2023)
- [Enterprise Benchmarks for Large Language Model Evaluation](https://mlsanity.com/paper/2410.12857/) (2024)
- [Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognition](https://mlsanity.com/paper/2401.10337/) (2024)
- [On the use of neurosymbolic AI for defending against cyber attacks](https://mlsanity.com/paper/2408.04996/) (2024)
- [Mining Temporal Attack Patterns from Cyberthreat Intelligence Reports](https://mlsanity.com/paper/2401.01883/) (2024)
- [TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs](https://mlsanity.com/paper/2607.24563/) (2026)
- [CTIGuardian: A Few-Shot Framework for Mitigating Privacy Leakage in Fine-Tuned LLMs](https://mlsanity.com/paper/2512.12914/) (2025)
- [Characterizing Resource Sharing Practices on Underground Internet Forum Synthetic Non-Consensual Intimate Image Content Creation Communities](https://mlsanity.com/paper/2604.12190/) (2026)
- [GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks](https://mlsanity.com/paper/2606.05844/) (2026)

## Abstract (arXiv)

Proactive approaches to security, such as adversary emulation, leverage information about threat actors and their techniques (Cyber Threat Intelligence, CTI). However, most CTI still comes in unstructured forms (i.e., natural language), such as incident reports and leaked documents. To support proactive security efforts, we present an experimental study on the automatic classification of unstructured CTI into attack techniques using machine learning (ML). We contribute with two new datasets for CTI analysis, and we evaluate several ML models, including both traditional and deep learning-based ones. We present several lessons learned about how ML can perform at this task, which classifiers perform best and under which conditions, which are the main causes of classification errors, and the challenges ahead for CTI analysis.