Overview

Cyber threat intelligence studies how to collect, organize, and apply evidence about attackers, malware, vulnerabilities, and tactics to guide defense. Common approaches extract entities and relationships from reports, map behaviors to frameworks such as MITRE ATT&CK, and organize findings in knowledge graphs for retrieval and analysis. Language models, retrieval-augmented systems, and specialized agents are increasingly used to classify threats, support investigations, and generate detection rules or hunt leads. A central challenge is making these outputs reliable and useful in practice: systems must ground claims in evidence, balance precision with recall, and be evaluated on realistic analyst workflows.

Latest papers

CardsList

41 papers6 papers in the last four weeks, up 20% on the four weeks before. 0.0% of all new papers.

  1. Beyond RAG for Cyber Threat Intelligence: A Systematic Evaluation of Graph-Based and Agentic Retrieval

    Apr 13, 2026Dzenan Hamzic, Florian Skopik, Max Landauer +2Graph Retrieval-Augmented GenerationRAG Evaluation

  2. AnonShield: Scalable On-Premise Pseudonymization for CSIRT Vulnerability Data

    Apr 5, 2026Cristhian Kapelinski, Douglas Lautert, Beatriz Machado +2Cyber Threat Intelligence

  3. Foundational Study on Authorship Attribution of Japanese Web Reviews for Actor Analysis

    Mar 24, 2026Hiroshi Matsubara, Shingo Matsugaya, Taichi Aoki +1Authorship AttributionCyber Threat Intelligence

  4. Operationalising Cyber Risk Management Using AI: Connecting Cyber Incidents to MITRE ATT&CK Techniques, Security Controls, and Metrics

    Mar 12, 2026Emad Sherif, Iryna Yevseyeva, Vitor Basto-Fernandes +1CybersecurityCyber Threat Intelligence

  5. CyberThreat-Eval: Can Large Language Models Automate Real-World Threat Research?

    Mar 10, 2026Xiangsen Chen, Xuan Feng, Shuo Chen +5LLM EvaluationCyber Threat Intelligence

  6. Cyber Threat Intelligence for Artificial Intelligence Systems

    Mar 5, 2026Natalia Krawczyk, Mateusz Szczepkowski, Adrian Brodzik +1Cyber Threat IntelligenceCybersecurity

  7. From Threat Intelligence to Firewall Rules: Semantic Relations in Hybrid AI Agent and Expert System Architectures

    Mar 4, 2026Chiara Bonfanti, Davide Colaiacomo, Luca Cagliero +1Autonomous Cyber DefenseCyber Threat Intelligence

  8. Federated Graph AGI for Cross-Border Insider Threat Intelligence in Government Financial Schemes

    Feb 18, 2026Srikumar Nayak, James WalmesleyCyber Threat IntelligenceFederated Graph Learning

  9. Toward Cybersecurity-Expert Small Language Models

    Oct 15, 2025Matan Levi, Daniel Ohayon, Ariel Blobstein +3Cyber Threat IntelligenceCybersecurity

  10. FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection

    Aug 26, 2025Shaswata Mitra, Subash Neupane, Martin Duclos +5Cyber Threat IntelligenceNetwork Intrusion Detection