# STIXnet: A Novel and Modular Solution for Extracting All STIX Objects in CTI Reports

arXiv: https://arxiv.org/abs/2303.09999 · HTML: https://mlsanity.com/paper/2303.09999/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Mar 2023.

## Built on by (most cited first, 10 of 10)

- [AGIR: Automating Cyber Threat Intelligence Reporting with Natural Language Generation](https://mlsanity.com/paper/2310.02655/) (2023)
- [Large Language Models Are Unreliable for Cyber Threat Intelligence](https://mlsanity.com/paper/2503.23175/) (2025)
- [On the use of neurosymbolic AI for defending against cyber attacks](https://mlsanity.com/paper/2408.04996/) (2024)
- [MITRE ATT&CK Applications in Cybersecurity and The Way Forward](https://mlsanity.com/paper/2502.10825/) (2025)
- [Towards a scalable AI-driven framework for data-independent Cyber Threat Intelligence Information Extraction](https://mlsanity.com/paper/2501.06239/) (2025)
- [TIJERE: A Novel Threat Intelligence Joint Extraction Model Based on Analyst Expert Knowledge](https://mlsanity.com/paper/2605.02041/) (2026)
- [Context-aware Entity-Relation Extraction for Threat Intelligence Knowledge Graphs](https://mlsanity.com/paper/2605.15904/) (2026)
- [RefinementEngine: Automating Intent-to-Device Filtering Policy Deployment under Network Constraints](https://mlsanity.com/paper/2604.01627/) (2026)
- [Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilities](https://mlsanity.com/paper/2607.16175/) (2026)
- [BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligence](https://mlsanity.com/paper/2608.28394/) (2026)

## Abstract (arXiv)

The automatic extraction of information from Cyber Threat Intelligence (CTI) reports is crucial in risk management. The increased frequency of the publications of these reports has led researchers to develop new systems for automatically recovering different types of entities and relations from textual data. Most state-of-the-art models leverage Natural Language Processing (NLP) techniques, which perform greatly in extracting a few types of entities at a time but cannot detect heterogeneous data or their relations. Furthermore, several paradigms, such as STIX, have become de facto standards in the CTI community and dictate a formal categorization of different entities and relations to enable organizations to share data consistently. This paper presents STIXnet, the first solution for the automated extraction of all STIX entities and relationships in CTI reports. Through the use of NLP techniques and an interactive Knowledge Base (KB) of entities, our approach obtains F1 scores comparable to state-of-the-art models for entity extraction (0.916) and relation extraction (0.724) while considering significantly more types of entities and relations. Moreover, STIXnet constitutes a modular and extensible framework that manages and coordinates different modules to merge their contributions uniquely and exhaustively. With our approach, researchers and organizations can extend their Information Extraction (IE) capabilities by integrating the efforts of several techniques without needing to develop new tools from scratch.