Jul 2026· Journal of Visualized Experiments· Vol 233· 0 citations
Medicine
TL;DR
The protocol documents a reproducible implementation for IOC-to-regex translation and explicitly delineates its current scope, operational assumptions, and known failure cases.
Abstract
Security Operations Centers (SOCs) routinely convert cyber threat intelligence (CTI) reports into operational detection content. A persistent bottleneck in this workflow is the translation of extracted indicators of compromise (IOCs) particularly file paths, registry keys, and command-line strings into deployable regular expressions (regexes) suitable for embedding in security information and event management (SIEM) correlation rules. Although prior work has improved automated indicator-of-compromise (IOC) extraction, transforming extracted strings into validated regex patterns remains largely manual, requires specialized expertise, and is prone to error. The goal of this protocol is to provide a standardized, reproducible procedure for IOC-to-regex translation. The workflow comprises five stages: (1) parsing heterogeneous CTI reports into a unified Markdown representation; (2) IOC extraction using multiple large language models (LLMs) with consensus voting; (3) rule-based normalization, categorization, and deduplication of extracted IOCs; (4) graph-assisted labeling of IOC components as keep (capture-group) or discard (non-capture-group); and (5) iterative regex generation with diagnostic validation against the original IOC strings. To assess utility, the workflow was applied to 3,156 CTI reports, and the resulting regexes were evaluated against more than 2,400 independently collected ground-truth strings from ten MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) Evaluation scenarios, yielding an average hit rate of 99.1 % and an average cross-IOC mismatch rate of 0.8 %. The protocol therefore documents a reproducible implementation for IOC-to-regex translation and explicitly delineates its current scope, operational assumptions, and known failure cases.
Cyber Threat Intelligence (CTI) enables Security Operations Centers (SOCs) to understand adversary behavior,
prioritize risks, and respond to cyber threats. However, cur-rent CTI workflows still depend heavily on manual analysis
of unstructured threat reports, vulnerability advisories, open-source intelligence, social media posts, and structured feeds. This
creates operational latency, inconsistent extraction quality, weak provenance, and limited scalability. This paper presents Auto
Threat AI, an agentic and explainable framework for automated CTI extraction, correlation, scoring, and analyst-governed SOC
operationalization. The proposed framework integrates determin-istic indicator extraction, Natural Language Processing (NLP),
schema-guided Large Language Model (LLM) agents, graph-aware threat correlation, bounded risk scoring, evidence-first
explainability, and Human-in-the-Loop (HITL) governance. The system ingests heterogeneous CTI sources, extracts entities and
relations such as IOCs, CVEs, malware, campaigns, threat actors, tools, and techniques, constructs a threat knowledge graph,
gen-erates campaign candidates, and presents risk-ranked intelligence through a SOC dashboard. Experimental evaluation on
safe demonstration CTI data shows that the implemented prototype ingested 6 sources, extracted 36 entities, generated 33
relations, detected 11 threat events, identified 5 campaign candidates, and routed 8 items for HITL review. The results
demonstrate that Auto Threat AI can reduce manual CTI processing effort while improving traceability, explainability, and
analyst trust.
Methari Keeravani· International Journal for Re...· 0 citations
AUTOSIGMA, an automated solution for transforming unstructured CTI reports into relevant Sigma rules that enables accurate, context-aware, and relevant rule generation, outperforms alternative solutions and LLM models in rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to input quality.
Sepehr Ghaffarzadegan, Boubakr Nour, M. Pourzandi et al.· 0 citations
Accurately mapping attack behaviors described in Cyber Threat Intelligence (CTI) reports to the Tactics, Techniques, and Procedures (TTPs) of the MITRE ATT&CK framework is a critical challenge for responding to cyber threats and enhancing cyber resilience. However, traditional Large Language Model (LLM) and Retrieval-Augmented Generation (RAG) approaches face significant limitations. Specifically, the simple segmentation of unstructured CTI text leads to context fragmentation and the inclusion of extraneous descriptive details, which ultimately degrades the accuracy of TTP mapping. To solve these limitations, this paper proposes a methodology for constructing RAG queries based on structured fields. We extract attack behaviors from CTI reports as discrete events and organize them into seven fields (four required and three optional) representing the core components of the attack, which are designed to facilitate effective mapping to the MITRE ATT&CK framework. Our approach utilizes an LLM to perform event extraction and constructs optimized RAG queries through field combinations, thereby enhancing semantic alignment during the retrieval process. Experimental results demonstrate that the proposed method improves the F1-score by 0.249 compared to the baseline TTPFShot, achieving a maximum F1-score of 0.489 with the domain-specific model SecureBERT2. Moreover, while structured queries improve precision by constraining the retrieval scope to mitigate retrieval noise and reduce false positives, the effect of additional fields varies depending on the characteristics of the embedding model. Specifically, domain-specific models reach their peak performance with concise field configurations, whereas general-purpose models peak with the configuration integrating all fields. These results indicate that designing field combinations suited to the characteristics of the embedding model is essential, and that the proposed methodology provides a practical framework for high-precision TTP identification in complex CTI environments.
Seo-yeon Kim, Saewoom Lee, Seul-Ki Choi et al.· International Conference on...· 0 citations
: Mapping unstructured Cyber Threat Intelligence (CTI) reports to the MITRE ATT&CK framework is critical for proactive defence but remains a manual, time-consuming process. Existing automated approaches either rely on black-box language models that lack interpretable reasoning or brittle, rule-based knowledge graphs that fail to scale. To bridge this gap, we propose Graph2TTP, a novel neural-symbolic framework for automated, paragraph-level Tactic, Technique and Procedure (TTP) identification. Graph2TTP leverages the zero-shot comprehension of Large Language Models (LLMs) to automatically extract entities and relations from extensive CTI narratives, constructing rich, localized Cyber Security Knowledge Graphs (CSKGs). We encode these symbolic structures into dense embeddings and process them via a multi-label Edge-featured Graph Attention Network (EGAT). This hybrid architecture delivers both the high-fidelity accuracy of neural networks and the transparent, verifiable reasoning paths required by security analysts. To facilitate rigorous evaluation, we curate and release APTCTI, a real-world dataset comprising 690 Advanced Persistent Threat reports spanning over 18,087 paragraphs. Extensive evaluations across multiple datasets demonstrate that Graph2TTP outperforms state-of-the-art neural baselines (e.g., CySecBERT) by approximately 20% in F1 score, establishing a robust new standard for accurate and interpretable threat intelligence analysis.
Patrick Zounon, Yufei Han, Michel Hurfin et al.· Proceedings of the 23rd Inte...· 0 citations
This paper proposes an automated framework that extracts reachable attack chains by modeling each attack step as an attack unit of preconditions, an attack behavior, and postconditions, and produces attack units that are more complete and consistent than those generated by end-to-end LLM baselines.
Wenbo Hou, N. Hu, Xueping Wang et al.· 0 citations
When a security researcher publishes a report on a cyberattack, detection engineers are supposed to turn it into working detection rules. In practice, most automated attempts at this only extract the simplest clues from the report --- bad IP addresses, domain names, and file hashes --- and turn them into block lists. This is a weak strategy, because attackers can change these simple clues within hours or days, so the resulting detections stop working almost as soon as they are deployed. Security teams describe this idea with the Pyramid of Pain. This project asks whether feeding a report into a knowledge-graph retrieval system, Microsoft GraphRAG, rather than a standard vector-similarity retrieval system (Naive RAG), produces detection plans that rely more on these durable, top-of-pyramid clues. Both systems are given the same report, the same generation instructions, and the same language model to write the final plan; only the retrieval step differs. In a detailed case study of one APT28 report, the GraphRAG plan kept firing at 100\% of its detections after every IP address, domain, and file hash in the report was rotated, while the Naive RAG plan kept firing at only 29\%. Repeating the comparison across nine real CTI reports from four vendors confirms the same pattern: GraphRAG plans consistently reach higher, harder-to-evade levels of the pyramid, even when the two systems end up close on total score. The results support treating knowledge-graph-aware retrieval as the architecturally correct foundation for automatically generating SOC-deployable hunting plans, while showing that the wording of the generation prompt matters almost as much as the retrieval back-end itself.
A. Kabra, Prakhar Paliwal, M. Hanawal· 0 citations