Cyber Threat Intelligence

Ask about this topic

Overview

Cyber threat intelligence studies how to collect, organize, and apply evidence about attackers, malware, vulnerabilities, and tactics to guide defense. Common approaches extract entities and relationships from reports, map behaviors to frameworks such as MITRE ATT&CK, and organize findings in knowledge graphs for retrieval and analysis. Language models, retrieval-augmented systems, and specialized agents are increasingly used to classify threats, support investigations, and generate detection rules or hunt leads. A central challenge is making these outputs reliable and useful in practice: systems must ground claims in evidence, balance precision with recall, and be evaluated on realistic analyst workflows.

Latest papers

CardsList

41 papers6 papers in the last four weeks, up 20% on the four weeks before. 0.0% of all new papers.

  1. Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure

    Oct 22, 2026Pellegrino Casoria, Simon Pietro RomanoSocial Media AnalysisCyber Threat Intelligence

    University of Naples Federico II, Department of Electrical Engineering and Information Technology (DIETI), Naples, Italy

  2. LLM-Based Weak Annotation for Cybersecurity Tweet Classification: A Teacher-Student Framework

    Oct 15, 2026Ferry Afit Kurniawan, Kazushi Okamoto, Koki Karube +2LLM-Assisted AnnotationText Classification

    Department of Informatics, Graduate School of Informatics and Engineering, The University of Electro-Communications 1-5-1 Chofugaoka, Chofu, Tokyo 182-8585, Japan

  3. DarKnight: Retrieval-Guided Agentic Framework for Breaking Dark Web CAPTCHA Gates

    Oct 14, 2026Binghui Wu, Yeo Zi Yi, Darren Tan +3CAPTCHA SolvingAgentic AI

    National University of Singapore Singapore · A*STAR Institute of Advanced Intelligence and Compute Singapore

  4. Unconstrained CTI-REALM with Open-Weights

    Oct 9, 2026Sahil Garg, Ruhi Gottumukkala, Vishal Agarwal +1AI Agent EvaluationAI Agent Security Benchmarks

    Averlon, Redmond, WA

  5. From Sandbox to Enforcement: Confidence-Qualified Threat Intelligence for Critical Infrastructure

    Oct 5, 2026Nikolaos Kekatos, Mihaela Curcă, Georgios Koutidis +5Cyber Threat IntelligenceCybersecurity

    Clone Systems, Cyprus · Romanian National Cyber Security Directorate (DNSC), Romania · Bolton Technologies, Cyprus +1

  6. Polar: LLM-Powered Synthesis of Real-World Cyber Evidence for Prioritization and Mitigation

    Oct 5, 2026Luoxi Tang, Yuqiao Meng, Ankita Patra +3CybersecurityCyber Threat Intelligence

    Binghamton University, State University of New York, Binghamton, NY, USA · Oakland University, Rochester, MI, USA · University of Iowa, Iowa City, IA, USA

  7. XPhysICS: Cross-Physical-Domain Threat Grounding for Industrial Control Systems Security

    Sep 25, 2026Sangshin Park, Jainta Paul, Lawrence Ponce +3Cyber-Physical SystemsCyber Threat Intelligence

    University of Utah, Salt Lake City, Utah, USA · Kahlert School of Computing, University of Utah, Salt Lake City, Utah, USA

  8. Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports

    Sep 8, 2026Akash Prakash, Boubakr Nour, Makan Pourzandi +2Retrieval-Augmented GenerationCyber Threat Intelligence

    Concordia University, Canada · Ericsson Security Research, Canada

  9. SCRIPTIOC-BENCH: A Benchmark for Recognizing Actionable Threat Intelligence from Script-Based Malware using LLMs

    Sep 5, 2026Hanna Kim, Jian Cui, Minkyoo Song +4Malware AnalysisLLMs for Cybersecurity

    KAIST · University of Illinois Urbana-Champaign · ETRI

  10. Federated Attack Campaign Detection via Contrastive Encoding of Threat Indicators in Gradient Updates

    Sep 4, 2026Manuel Röder, Bibin Babu, Frank-Michael SchleifFederated LearningCyber Threat Intelligence

    Technical University of Applied Sciences Würzburg-Schweinfurt, Würzburg, Germany · Bielefeld University, Bielefeld, Germany · Center for Cybersecurity TTZ-WUE, Ochsenfurt, Germany

  11. Ranked by the Matcher: A Reproducibility Audit of Knowledge Graph Extraction from Threat Reports

    Sep 1, 2026Safayat Bin Hakim, Houbing Herbert SongKnowledge GraphsKG Construction

    University of Maryland, Baltimore County Baltimore, Maryland, USA

  12. BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligence

    Aug 28, 2026Changze Li, Yutong Cheng, Tsania Camila Finnisa +3KG Entity AlignmentKG Construction

    Virginia Tech Blacksburg, United States · Dian Nuswantoro University Jepara, Indonesia · Amazon Seattle, United States

  13. DisCTI: Who Needs to Know Timely? Automated Sector-Aware Cyber Threat Intelligence Dissemination

    Aug 28, 2026Fajar Wijitrisnanto, Alsharif Abuadbba, Yansong Gao +1Cyber Threat Intelligence

    National Cyber and Crypto Agency, Jakarta, Indonesia · CSIRO, Sydney, Australia · The University of Western Australia, Perth, Australia

  14. From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation

    Aug 19, 2026Sepehr Ghaffarzadegan, Boubakr Nour, Makan Pourzandi +2Cyber Threat IntelligenceLLMs for Cybersecurity

    Concordia University, Montréal, Canada · Ericsson Research, Ericsson, Montréal, Canada

  15. CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence

    Aug 19, 2026Yutong Cheng, Changze Li, Qian Cui +4Cyber Threat IntelligenceAgentic Retrieval

    Virginia Tech · Amazon · Northwestern University

  16. Operationalizing Cyber Threat Intelligence with GraphRAG

    Aug 13, 2026Atul Kabra, Prakhar Paliwal, Manjesh K. HanawalCyber Threat IntelligenceGraph Retrieval-Augmented Generation

    MLiONS, Department of IEOR, IIT Bombay Mumbai, Maharashtra, India

  17. Retrieval-Constrained Policy Optimization for Attack Technique Extraction from Cyber Threat Intelligence

    Aug 7, 2026Jiayun Zhang, Junshen Xu, Zejun Xie +1Cyber Threat IntelligenceCybersecurity

    Amazon Web Services New York, New York, USA · Amazon Web Services Boston, Massachusetts, USA · Rutgers University Piscataway, New Jersey, USA

  18. TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs

    Jul 27, 2026Federico Valletta, Giacomo Longo, Enrico Russo +1KG ConstructionAI Assurance

    CASD – School of Advanced Defense Studies, Piazza della Rovere 83, 00165 Rome, Italy

  19. An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

    Jul 22, 2026Wenbo Hou, Ning Hu, Xueping Wang +2Reachability AnalysisCyber Threat Intelligence

    Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies, School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, China · New Network Research Department, Peng Cheng Laboratory, Shenzhen, China · Great Bay University, Dongguan, China

  20. SMETA-ZSL:Semantic Meta-Alignment for Zero-Shot Threat Classification

    Jul 10, 2026Ivan Alejandro Montoya Sanchez, Anantaa Kotal, Aritran PiplaiZero-Shot LearningCyber Threat Intelligence

    The University of Texas at El Paso

  21. TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction

    Jul 6, 2026Mouhamed Amine Bouchiha, Gregory BlancKG ConstructionMulti-Agent LLM Systems

    SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris

  22. CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors

    Jun 30, 2026Swati Yadav, Dincy R. Arikkat, Basant Agarwal +3KG ConstructionCyber Threat Intelligence

    Department of Computer Science & Engineering Swami Keshvanand Institute of Technology, Management & Gramothan, Jaipur · Department of Computer Science and Engineering Christ College of Engineering Thrissur, Kerala · Department of Computer Science & Engineering Central University of Rajasthan, Ajmer +2

  23. Evaluating Open-Source LLMs for Multi-Label ATT&CK Technique Classification on CTI Reports

    Jun 16, 2026Ahmed Ryan, Saad Sakib Noor, Md Erfan +3LLM EvaluationCyber Threat Intelligence

    The University of Alabama · The University of Dhaka

  24. Cognitive Threat Intelligence and Explainable Federated Security Analytics for distributed Infrastructure Systems

    Jun 4, 2026Md. Arifur Rahman, B. M. Taslimul Haque, Md. Iqbal Hossan +1Cyber Threat IntelligenceNetwork Intrusion Detection

    Dept. of Information Studies, Trine University, Angola, Indiana · Dept. of Business Information Systems, Central Michigan University, Mount Pleasant, Michigan · Dept. of CS, Maharishi International University, Fairfield, Iowa, USA

  25. CTI2TTP: Evidence-Grounded TTP Extraction from Cyber Threat Intelligence via Diverge-then-Converge Verification

    May 25, 2026Yutong Cheng, Changze Li, Raihan Sultan Pasha Basuki +3Cyber Threat IntelligenceDocument Information Extraction

    Virginia Tech · Universitas Ary Ginanjar, Jakarta, Indonesia · Amazon

  26. Signals in the Noise: Open Source Intelligence (OSINT) for AI Loss of Control Detection

    May 22, 2026Sarah Bollinger, Nada Aboserie, Amanda Coakley +2Cyber Threat IntelligenceAI Governance

    AI Governance Taskforce, Arcadia Impact

  27. GRID: Graph Representation of Intelligence Data for Security Text Knowledge Graph Construction

    May 15, 2026Liangyi Huang, Zichen Liu, Fei Shao +5KG ConstructionCyber Threat Intelligence

    Arizona State University · Case Western Reserve University · University of Notre Dame +2

  28. Context-aware Entity-Relation Extraction for Threat Intelligence Knowledge Graphs

    May 15, 2026Inoussa Mouiche, sherif SaadRelation ExtractionKG Construction

    School of Computer Science, University of Windsor, ON, Canada

  29. TIJERE: A Novel Threat Intelligence Joint Extraction Model Based on Analyst Expert Knowledge

    May 3, 2026Inoussa Mouiche, Sherif SaadRelation ExtractionNamed Entity Recognition

    School of Computer Science, University of Windsor, 401 Sunset Ave, Windsor, N9B 3P4, ON, Canada

  30. MCPThreatHive: Automated Threat Intelligence for Model Context Protocol Ecosystems

    Apr 15, 2026Yi Ting Shen, Kentaroh Toyoda, Alex LeungMCP SecurityAI Agent Security

    Vulcan Research, AIFT