mlsanityData to 7 Oct 2026

Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI

arXiv 2211.01753 ↗First posted 1 Nov 2022cs.CR cs.LGcited by 27

Not on the map. Why?

Abstract (arXiv)

Public and commercial organizations extensively share cyberthreat intelligence (CTI) to prepare systems to defend against existing and emerging cyberattacks. However, traditional CTI has primarily focused on tracking known threat indicators such as IP addresses and domain names, which may not provide long-term value in defending against evolving attacks. To address this challenge, we propose to use more robust threat intelligence signals called attack patterns. LADDER is a knowledge extraction framework that can extract text-based attack patterns from CTI reports at scale. The framework characterizes attack patterns by capturing the phases of an attack in Android and enterprise networks and systematically maps them to the MITRE ATT&CK pattern framework. LADDER can be used by security analysts to determine the presence of attack vectors related to existing and emerging threats, enabling them to prepare defenses proactively. We also present several use cases to demonstrate the application of LADDER in real-world scenarios. Finally, we provide a new, open-access benchmark malware dataset to train future cyberthreat intelligence models.

Key facts. Cited by 27 papers in the map (data through 7 Oct 2026). Builds on 24 of its 89 references that are in the map. First posted on arXiv 1 Nov 2022.

Builds on

24 of 89 references.

References · 24

  1. 2017Attention Is All You Needcited by 59,932
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  4. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  5. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  6. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
  7. 2019Unsupervised Cross-lingual Representation Learning at Scalecited by 3,907
  8. 2019HuggingFace's Transformers: State-of-the-art Natural Language Processingcited by 2,201
  9. 2020A Survey on Knowledge Graphs: Representation, Acquisition and Applicationscited by 643
  10. 2019TuckER: Tensor Factorization for Knowledge Graph Completioncited by 290
  11. 2018A Survey on Deep Learning for Named Entity Recognitioncited by 281
  12. 2015A Review of Relational Machine Learning for Knowledge Graphscited by 264
12 more
  1. 2019Enriching Pre-trained Language Model with Entity Information for Relation Classificationcited by 82
  2. 2022T-NER: An All-Round Python Library for Transformer-based Named Entity Recognitioncited by 37
  3. 2021AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reportscited by 31
  4. 2019CESI: Canonicalizing Open Knowledge Bases using Embeddings and Side Informationcited by 28
  5. 2019POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Huntingcited by 27
  6. 2021EXTRACTOR: Extracting Attack Behavior from Threat Reportscited by 19
  7. 2013Automatic Labeling for Entity Extraction in Cyber Securitycited by 13
  8. 2019RelExt: Relation Extraction using Deep Learning approaches for Cybersecurity Knowledge Graph Improvementcited by 12
  9. 2015Towards a relation extraction framework for cyber-security conceptscited by 9
  10. 2020MALOnt: An Ontology for Malware Threat Intelligencecited by 8
  11. 2019ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattackscited by 6
  12. 2021TINKER: A framework for Open source Cyberthreat Intelligencecited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 7; 2025: 9; 2026: 10.

27 papers.

Sort:

By area:

  1. 2024LLMCloudHunter: Harnessing LLMs for Automated Extraction of Detection Rules from Cloud-Based CTIcited by 17
  2. 2023Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wildcited by 15
  3. 2024Actionable Cyber Threat Intelligence using Knowledge Graphs and Large Language Modelscited by 14
  4. 2024CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Modelscited by 12
  5. 2025Large Language Models for Security Operations Centers: A Comprehensive Surveycited by 9
  6. 2024MORPH: Towards Automated Concept Drift Adaptation for Malware Detectioncited by 8
  7. 2024Crimson: Empowering Strategic Reasoning in Cybersecurity through Large Language Modelscited by 8
  8. 2025TechniqueRAG: Retrieval Augmented Generation for Adversarial Technique Annotation in Cyber Threat Intelligence Textcited by 6
  9. 2025Large Language Models Are Unreliable for Cyber Threat Intelligencecited by 5
  10. 2025AttackSeqBench: Benchmarking the Capabilities of LLMs for Attack Sequences Understandingcited by 3
  11. 2025From Texts to Shields: Convergence of Large Language Models and Cybersecuritycited by 3
  12. 2024AI-Driven Cyber Threat Intelligence Automationcited by 2
15 more
  1. 2025False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systemscited by 2
  2. 2025CTIConnect: A Benchmark for Retrieval-Augmented LLMs over Heterogeneous Cyber Threat Intelligencecited by 2
  3. 2026Constructing Multi-label Hierarchical Classification Models for MITRE ATT&CK Text Taggingcited by 1
  4. 2026TTPrint: Evidence-Grounded TTP Extraction via Diverge-then-Converge Verificationcited by 1
  5. 2026TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Constructioncited by 1
  6. 2026TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphscited by 1
  7. 2024Cyber-Attack Technique Classification Using Two-Stage Trained Large Language Modelscited by 0
  8. 2025CTIGuardian: A Few-Shot Framework for Mitigating Privacy Leakage in Fine-Tuned LLMscited by 0
  9. 2025From Retrieval to Reasoning: A Framework for Cyber Threat Intelligence NER with Explicit and Adaptive Instructionscited by 0
  10. 2026GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attackscited by 0
  11. 2026Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluationcited by 0
  12. 2026Retrieval-Constrained Policy Optimization for Attack Technique Extraction from Cyber Threat Intelligencecited by 0
  13. 2026Operationalizing Cyber Threat Intelligence with GraphRAGcited by 0
  14. 2026CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligencecited by 0
  15. 2026BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligencecited by 0