# CTI Dataset Construction from Telegram

arXiv: https://arxiv.org/abs/2509.20943 · HTML: https://mlsanity.com/paper/2509.20943/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 29 references that are in the map.
- First posted on arXiv 25 Sep 2025.

## Builds on (most cited first, 9 of 9)

- [RoBERTa: A Robustly Optimized BERT Pretraining Approach](https://mlsanity.com/paper/1907.11692/) (2019)
- [DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter](https://mlsanity.com/paper/1910.01108/) (2019)
- [How to Fine-Tune BERT for Text Classification?](https://mlsanity.com/paper/1905.05583/) (2019)
- [CySecBERT: A Domain-Adapted Language Model for the Cybersecurity Domain](https://mlsanity.com/paper/2212.02974/) (2022)
- [What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey](https://mlsanity.com/paper/2109.06808/) (2021)
- [Processing Tweets for Cybersecurity Threat Awareness](https://mlsanity.com/paper/1904.02072/) (2019)
- [NLP-Based Techniques for Cyber Threat Intelligence](https://mlsanity.com/paper/2311.08807/) (2023)
- [DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram](https://mlsanity.com/paper/2409.14596/) (2024)
- [A Crawler Architecture for Harvesting the Clear, Social, and Dark Web for IoT-Related Cyber-Threat Intelligence](https://mlsanity.com/paper/2109.06932/) (2021)

## Abstract (arXiv)

Cyber Threat Intelligence (CTI) enables organizations to anticipate, detect, and mitigate evolving cyber threats. Its effectiveness depends on high-quality datasets, which support model development, training, evaluation, and benchmarking. Building such datasets is crucial, as attack vectors and adversary tactics continually evolve. Recently, Telegram has gained prominence as a valuable CTI source, offering timely and diverse threat-related information that can help address these challenges. In this work, we address these challenges by presenting an end-to-end automated pipeline that systematically collects and filters threat-related content from Telegram. The pipeline identifies relevant Telegram channels and scrapes 145,349 messages from 12 curated channels out of 150 identified sources. To accurately filter threat intelligence messages from generic content, we employ a BERT-based classifier, achieving an accuracy of 96.64%. From the filtered messages, we compile a dataset of 86,509 malicious Indicators of Compromise, including domains, IPs, URLs, hashes, and CVEs. This approach not only produces a large-scale, high-fidelity CTI dataset but also establishes a foundation for future research and operational applications in cyber threat detection.