Automated Threat Actor Profiling with AI in Cyber Threat Intelligence: A Framework for Real-Time Extraction and Attribution
Automated Threat Actor Profiling with AI in Cyber Threat Intelligence: A Framework for Real-Time Extraction and Attribution

Summary/Abstract: Cyber threat intelligence (CTI) has become essential for a proactive defending against adversaries in cyberspace. However, the majority of valuable information resides in vast volumes of unstructured data and feeds, which renders their analysis an extremely lengthy and error-prone process. This paper aims to present a real-time automated framework that utilizes Natural Lan-guage Processing (NLP) and standardized ontologies such as Structured Threat Information Ex-pression (STIX) v2.1 and MITRE ATT&CK to identify indicators of compromise (IoCs), tactics, techniques and procedures (TTPs) from multiple CTI sources and correlate them with a threat ac-tor profile. The approach described in it digests data from open-source threat reports, social media and other sharing platforms. It also uses domain-specific language models and rule-based ana-lyzers to identify entities (e.g. malware, tools, targets), mapping them to STIX objects and linking extracted TTPs to ATT&CK techniques. The framework is tested with a hypothetical ransomware case study, which displays how through extracted indicators, killchain stages and behavioural patterns could be associated with a threat-actor profile. The results demonstrate that the suggest-ed AI-driven pipeline could enormously reduce the manual effort in CTI processing, maintaining high extraction accuracy. The work lays the foundation for implementing automatic CTI profiling of adversaries aiding with proactive defense and attribution efforts.

• Details
• Contents