Artificial Intelligence for Cyber Threat Intelligence Automation

The proposed Artificial Intelligence-driven Cyber Threat Intelligence (CTI) framework demonstrates how transformer-based Natural Language Processing and Graph Neural Networks can be integrated to automate the collection, extraction, correlation, and contextualization of cyber threat information. The framework transforms unstructured threat narratives into structured STIX 2.1 intelligence while mapping extracted entities and relationships to the MITRE ATT&CK framework. The experimental results show that the proposed SecBERT-based approach achieved an F1-score of 94.2%, outperforming the standard BERT and SVM-based approaches. The system also demonstrated a significant reduction in semantic false positives and reduced the average threat-triage time from approximately 112 minutes in the manual workflow to around 4.2 seconds in the tested automated environment. These findings indicate that AI-based CTI automation can significantly improve the speed, consistency, and contextual quality of threat intelligence processing. At the same time, the study recognizes that AI should not completely replace human security analysts. Novel attack techniques, ambiguous intelligence, adversarially manipulated content, and high-impact security incidents may still require expert validation. Therefore, a human-in-the-loop approach provides a practical balance between automated processing and human decision-making. Overall, the study establishes that combining transformer-based NLP with graph-based threat analysis provides a promising foundation for scalable CTI automation. By reducing repetitive manual work and producing standardized, contextual, and actionable intelligence, the roposed framework can support modern SOC, SIEM, and SOAR environments and contribute to faster and more effective cybersecurity response.

[1]   A. Vaswani et al., “Attention Is All You Need,” in Advances in Neural Information Processing Systems 30, 2017. [2]   J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding,” in Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT), Minneapolis, MN, 2019, pp. 4171–4186. [3]   E. Aghaei, X. Niu, W. Shadid, and E. Al-Shaer, “SecureBERT: A Domain-Specific Language Model for Cybersecurity,” arXiv:2204.02685, 2022. [4]  P. Ranade, A. Piplai, A. Joshi, and T. Finin, “CyBERT: Contextualized Embeddings for the Cybersecurity Domain,” in Proceedings of the 2021 IEEE International Conference on Big Data, 2021, pp. 3334–3342, doi: 10.1109/BigData52589.2021.9671824. [5]  Y. Park and W. You, “A Pretrained Language Model for Cyber Threat Intelligence,” in Proceedings of the 2023 Conference on Empirical  Methods  in  Natural  Language Processing: Industry Track, Singapore, 2023, pp. 113–122, doi: 10.18653/v1/2023.emnlp-industry.12. [6]   Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang, and P. S. Yu, “A Comprehensive Survey on Graph Neural Networks,” IEEE Transactions on Neural Networks and Learning Systems, vol. 32, no. 1, pp. 4–24, Jan.   2021, doi: 10.1109/TNNLS.2020.2978386. [7]   A. M. Høst, P. Lison, and L. Moonen, “Constructing a Knowledge Graph from Textual Descriptions of Software Vulnerabilities in the National Vulnerability Database,” in Proceedings of the 24th Nordic Conference on Computational Linguistics (NoDaLiDa), 2023, pp. 386–391. [8]   Z. Li, J. Zeng, Y. Chen, and Z. Liang, “AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports,” in Proceedings of the 27th European Symposium on Research in Computer Security (ESORICS), 2022, pp. 589–609,  doi:  10.1007/978-3-031-17140- 6_29. [9]  B. E. Strom, A. Applebaum, D. P. Miller, K. C. Nickels, A. G. Pennington, and C. B. Thomas, “MITRE ATT&CK: Design and Philosophy,” MITRE Corporation, Technical Report, Jul. 2018 (rev. Mar. 2020). [10]   G. Husari, E. Al-Shaer, M. Ahmed, B. Chu, and X. Niu, “TTPDrill: Automatic and Accurate Extraction of Threat Actions from Unstructured Text of CTI Sources,” in Proceedings of the 33rd Annual Computer Security Applications Conference (ACSAC), 2017,           pp.           103–115,           doi: 10.1145/3134600.3134646.