Metraipolis › archive › dc_bfab2ffb5e86

DisCTI: Who Needs to Know Timely? Automated Sector-Aware Cyber Threat Intelligence Dissemination — arXiv:2608.27967

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.27967
License (as archived): CC0-1.0
Archived: 2026-10-17T10:56:43.973Z
SHA-256 of the archived text: e5e1acfe25c5950a8cd47200b9a66e731761074d005d174382311915cf597357
Stable URL of this page: https://metraipolis.com/documento/dc_bfab2ffb5e86

How to cite

DisCTI: Who Needs to Know Timely? Automated Sector-Aware Cyber Threat Intelligence Dissemination — arXiv:2608.27967 — arXiv (en), https://arxiv.org/abs/2608.27967 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_bfab2ffb5e86 (Metraipolis archive dc_bfab2ffb5e86, sha256 e5e1acfe25c5950a8cd47200b9a66e731761074d005d174382311915cf597357)

BibTeX

@misc{dcbfab2ffb5e86,
  title = {DisCTI: Who Needs to Know Timely? Automated Sector-Aware Cyber Threat Intelligence Dissemination — arXiv:2608.27967},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.27967},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_bfab2ffb5e86; sha256 e5e1acfe25c5950a8cd47200b9a66e731761074d005d174382311915cf597357},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.27967. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

The timely dissemination of cyber threat intelligence (CTI) is critical for organizations to mount swift and effective incident response. When valid CTI is delivered to the right sector at the right time, identical attacks can often be contained or mitigated. However, today's rapidly expanding CTI landscape overwhelms analysts, who must sift through massive and heterogeneous feeds. Existing platforms such as the Malware Information Sharing Platform (MISP) provide sector tagging features (e.g., energy, finance, government), but in practice, these remain largely unmapped (98% of events are left uncategorized). This lack of automated and timely sector mapping severely limits the operational value of shared intelligence, leaving organizations that belong especially to the critical information infrastructure sector exposed. To address this gap, we formulate sector-targeted CTI dissemination as a multilabel classification problem. Leveraging deep field knowledge of CTI structures and sector-specific threat patterns, we construct a novel data set of 872 sector-labelled CTI events from a threat intelligence platform (TIP). We then apply BERT, a transformer-based model, to automate the mapping of CTI events to sectors. Using the structured threat information expression (STIX) format for cross-platform interoperability, our approach achieves a macro-averaged F1-score of 0.89 at a Hamming loss of 0.055 on the custom dataset, i.e. 94.5% of individual sector-label assignments are correct. These results not only demonstrate the feasibility of sector-aware, automated CTI dissemination but also highlight how embedding expert field knowledge into machine learning design fills a crucial gap in the threat intelligence pipeline, enabling faster and context-relevant defensive action.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-08-31 in cs.CL).
Categorie arXiv: Cryptography and Security (cs.CR) ; Computation and Language (cs.CL).
Pagina del lavoro: https://arxiv.org/abs/2608.27967 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-17T10:47:33.161Z dalla pagina https://arxiv.org/catchup/cs.CL/2026-08-31?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).