False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systems
Not on the map. Why?
Abstract (arXiv)
Cyber Threat Intelligence (CTI) has emerged as a vital complementary approach that operates in the early phases of the cyber threat lifecycle. CTI involves collecting, processing, and analyzing threat data to provide a more accurate and rapid understanding of cyber threats. Due to the large volume of data, automation through Machine Learning (ML) and Natural Language Processing (NLP) models is essential for effective CTI extraction. These automated systems leverage Open Source Intelligence (OSINT) from sources like social networks, forums, and blogs to identify Indicators of Compromise (IoCs). Although prior research has focused on adversarial attacks on specific ML models, this study expands the scope by investigating vulnerabilities within various components of the entire CTI pipeline and their susceptibility to adversarial attacks. These vulnerabilities arise because they ingest textual inputs from various open sources, including real and potentially fake content. We analyse three types of attacks against CTI pipelines, including evasion, flooding, and poisoning, and assess their impact on the system's information selection capabilities. Specifically, on fake text generation, the work demonstrates how adversarial text generation techniques can create fake cybersecurity and cybersecurity-like text that misleads classifiers, degrades performance, and disrupts system functionality. The focus is primarily on the evasion attack, as it precedes and enables flooding and poisoning attacks within the CTI pipeline.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 30 of its 78 references that are in the map. First posted on arXiv 5 Jul 2025.
Builds on
30 of 78 references.
References · 30
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2020Longformer: The Long-Document Transformercited by 3,413
- 2019Transformer-XL: Attentive Language Models Beyond a Fixed-Length Contextcited by 1,850
- 2019Defending Against Neural Fake Newscited by 559
- 2018Statistical Aspects of Wasserstein Distancescited by 203
- 2023Increasing Diversity While Maintaining Accuracy: Text Data Generation with Large Language Models and Human Interventionscited by 125
- 2022Machine Generated Text: A Comprehensive Survey of Threat Models and Detection Methodscited by 79
- 2024CTIBench: A Benchmark for Evaluating LLMs in Cyber Threat Intelligencecited by 62
- 2022SecureBERT: A Domain-Specific Language Model for Cybersecuritycited by 60
- 2019A Survey of Black-Box Adversarial Attacks on Computer Vision Modelscited by 37
- 2020Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detectioncited by 33
- 2021Generating Fake Cyber Threat Intelligence Using Transformer-Based Modelscited by 29
18 more
- 2022Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTIcited by 27
- 2022Machine Learning Security against Data Poisoning: Are We There Yet?cited by 23
- 2021EXTRACTOR: Extracting Attack Behavior from Threat Reportscited by 19
- 2020Generating Natural Language Adversarial Examples on a Large Scale with Generative Modelscited by 15
- 2022Do Perceptually Aligned Gradients Imply Adversarial Robustness?cited by 15
- 2021What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A surveycited by 14
- 2024Evaluation of LLM Chatbots for OSINT-based Cyber Threat Awarenesscited by 14
- 2024CyberPal.AI: Empowering LLMs with Expert-Driven Cybersecurity Instructionscited by 12
- 2019Processing Tweets for Cybersecurity Threat Awarenesscited by 10
- 2024KGV: Integrating Large Language Models with Knowledge Graphs for Cyber Threat Intelligence Credibility Assessmentcited by 9
- 2018Mining Threat Intelligence about Open-Source Projects and Libraries from Code Repository Issues and Bug Reportscited by 6
- 2019Cyberthreat Detection from Twitter using Deep Neural Networkscited by 6
- 2019A Novel Approach for Detection and Ranking of Trendy and Emerging Cyber Threat Events in Twitter Streamscited by 5
- 2025Towards Effective Identification of Attack Techniques in Cyber Threat Intelligence Reports using Large Language Modelscited by 5
- 2022From Threat Reports to Continuous Threat Intelligence: A Comparison of Attack Technique Extraction Methods from Textual Artifactscited by 3
- 2019Collecting Indicators of Compromise from Unstructured Text of Cybersecurity Articles using Neural-Based Sequence Labellingcited by 2
- 2024AnnoCTR: A Dataset for Detecting and Linking Entities, Tactics, and Techniques in Cyber Threat Reportscited by 2
- 2024EaTVul: ChatGPT-based Evasion Attack Against Software Vulnerability Detectioncited by 2
Built on by
Citing papers per year: 2025: 1; 2026: 1.
2 papers.