Can LLM-generated misinformation be detected: A study on Cyber Threat Intelligence

The growing complexity of cyber threats, especially within critical infrastructure sectors like healthcare, energy, and maritime, highlights the need for comprehensive frameworks to facilitate the exchange of Cyber Threat Intelligence (CTI). This paper presents a CTI Exchange Governance Model aimed at enhancing the CTI sharing process within the DYNAMO platform, a European Union initiative focused on improving resilience against cyber threats across various phases of the resilience cycle: Prepare, Prevent, Protect, Respond, Recover, and Learn & Adapt. The DYNAMO project provides a suite of tools and strategies to support organizations in critical sectors, enabling efficient threat detection, mitigation, and response while fostering collaboration and compliance with regulatory standards. Sector-specific scenarios have been developed to address unique vulnerabilities in areas like healthcare, energy, and maritime, ensuring practical and targeted solutions for improving cyber resilience. While DYNAMO’s integrated tools handle CTI generation and alerts, a standardized and cohesive framework is still needed to guide and streamline CTI sharing across sectors, addressing gaps in current practices that impact interoperability and timely response. This governance model is structured around five key pillars: Collaboration & Trust, Data Sensitivity & Standardization, Compliance & Regulatory Alignment, Real-Time Collaboration & Response, and Continuous Learning & Improvement. These pillars ensure a secure, standardized, and compliant approach to CTI exchange, particularly in sectors vulnerable to increasingly sophisticated attacks. The model is uniquely tailored to align with DYNAMO's mission, offering a sector-specific approach while integrating best practices from established cybersecurity frameworks. The model is operationalized through the DYNAMO platform, leveraging tools like the Early Warning System (EWS) for real-time CTI sharing and a Data Anonymization Tool to ensure privacy and regulatory compliance. As a result, a practical framework has been developed to tailor the model’s implementation across healthcare, energy, and maritime sectors, ensuring a scalable and adaptable approach to CTI sharing. Ultimately, the governance model enhances CTI exchange by addressing interoperability challenges and strengthens governance practices to support collaboration, improve incident response times, and foster continuous improvement.

Cyber Threat Intelligence (CTI) is an important asset for organisations to facilitate the safeguarding of their systems against new and emerging cyber threats. CTI continuously provides up-to-date information which enables the design and implementation of better security measures and mitigation strategies. Organisations gather data from different sources either internal or external to the organisation, which are analysed, resulting in CTI. Nevertheless, the gathered data usually contain a large amount of content that is irrelevant to CTI or even to cybersecurity. Furthermore, most approaches concerning CTI management (e.g., gathering, analysis) involve simply gathering and storing the information without any enrichment such as classification or correlation. However, in order to obtain optimal results, organisations should be able to utilise all capabilities of CTI. Therefore, in this work, we propose ThreatWise AI, a novel framework that enables the gathering, analysis, enrichment, storage, and sharing of CTI in an efficient and secure manner. In particular, we have developed a novel pipeline in ThreatWise AI which incorporates different advanced tools, with distinct capabilities that interact with each other to provide a complete set of functionalities for the administration of the overall CTI lifecycle. The developed tools integrate various Python scripts and provide gathering and analysis functionalities of CTI. Furthermore, the proposed framework leverages the MISP platform for storing, enriching and sharing while also integrating Artificial Intelligence (AI) and Machine Learning (ML) algorithms for advanced data enrichment.

Cyber-attack is one of the significant threats affecting to any organisation specifically to the Critical Infrastructure (CI) organisation. These attacks are nowadays more sophisticated, multi-vectored and less predictable, which make the Cyber Security Risk Management (CSRM) task more challenging. Critical Infrastructure needs a new line of security defence to control these threats and minimise risks. Cyber Threat Intelligence (CTI) provides evidence-based information about the threats aiming to prevent threats. There are existing works and industry practice that emphasise the necessity of CTI and provides methods for threat intelligence and sharing. However, despite these significant efforts, there is a lack of focus on how CTI information can support the CSRM activities so that the organisation can undertake appropriate controls to mitigate the risk proactively. This paper aims to fill this gap by integrating CTI for improving cybersecurity risks management practice specifically focusing on the critical infrastructure. In particular, the proposed approach contributes beyond state of the art practice by incorporating CTI information for the risk management activities. This helps the organisation to provide adequate and appropriate controls from strategic, tactical and operational perspectives. We have integrated concepts relating to CTI and CSRM so that threat actor's profile, attack detailed can support calculating the risk. We consider smart grid system as a Critical Infrastructure to demonstrate the applicability of the work. The result shows that cyber risks in critical infrastructures can be minimised if CTI information is gathered and used as part of CSRM activities. CTI not only supports understanding of threat for accurate risk estimation but also evaluates the effectiveness of existing controls and recommend necessity controls to improve overall cybersecurity. Also, the result shows that our approach provides early warning about issues that need immediate attention.

Cyber threats continue to evolve in complexity, thereby traditional cyber threat intelligence (CTI) methods struggle to keep pace. AI offers a potential solution, automating and enhancing various tasks, from data ingestion to resilience verification. This paper explores the potential of integrating artificial intelligence (AI) into CTI. We provide a blueprint of an AI-enhanced CTI processing pipeline and detail its components and functionalities. The pipeline highlights the collaboration between AI and human expertise, which is necessary to produce timely and high-fidelity cyber threat intelligence. We also explore the automated generation of mitigation recommendations, harnessing AI’s capabilities to provide real-time, contextual, and predictive insights. However, the integration of AI into CTI is not without its challenges. Thereby, we discuss the ethical dilemmas, potential biases, and the imperative for transparency in AI-driven decisions. We address the need for data privacy, consent mechanisms, and the potential misuse of technology. Moreover, we highlight the importance of addressing biases both during CTI analysis and within AI models, warranting their transparency and interpretability. Lastly, our work points out future research directions, such as the exploration of advanced AI models to augment cyber defenses, and human–AI collaboration optimization. Ultimately, the fusion of AI with CTI appears to hold significant potential in the cybersecurity domain.

This paper presents a comprehensive survey of the applications, challenges, and limitations of Generative AI (GenAI) in enhancing threat intelligence within cybersecurity, supported by real-world case studies. We examine a wide range of data sources in Cyber Threat Intelligence (CTI), including security reports, blogs, social media, network traffic, malware samples, dark web data, and threat intelligence platforms (TIPs). This survey provides a full reference for integrating GenAI into CTI. We discuss various GenAI models such as Large Language Models (LLMs) and Deep Generative Models (DGMs) like Variational Autoencoders (VAEs), Generative Adversarial Networks (GANs), and Diffusion Models, explaining their roles in detecting and addressing complex cyber threats. The survey highlights key applications in areas such as malware detection, network traffic analysis, phishing detection, threat actor attribution, and social engineering defense. We also explore critical challenges in deploying GenAI, including data privacy, security concerns, and the need for interpretable and transparent models. As regulations like the European Commission’s AI Act emerge, ensuring trustworthy AI solutions is becoming more crucial. Real-world case studies, such as the impact of the WannaCry ransomware, the rise of deepfakes, and AI-driven social engineering, demonstrate both the potential and current limitations of GenAI in CTI. Our goal is to provide foundational insights and strategic direction for advancing GenAI’s role in future cybersecurity frameworks, emphasizing the importance of innovation, adaptability, and ongoing learning to enhance resilience against evolving cyber threats. Ultimately, this survey offers critical insights into how GenAI can shape the future of cybersecurity by addressing key challenges and providing actionable guidance for effective implementation.

The healthcare information system (HIS) has become a victim of cyberattacks. Traditional ways to handle cyber incidents in healthcare organizations follow a predefined incident response (IR) procedure. However, this procedure is usually reactive, missing the opportunities to foresee danger on the horizon. Cyber threat intelligence (CTI) contains information on emerging attacks and should be ideally utilized to inform the IR procedure. However, current research shows that the IR has not been effectively informed by CTI, especially in healthcare organizations. This paper fills in this gap by proposing a proactive IR response procedure based on the National Institute of Standards and Technology (NIST) IR methodology. This paper then presents the NHS WannaCry case study to demonstrate the use of the proposed IR methodology. We collate cyber security advisories from different CTI sources such as US/UK CERT to protect interconnected systems and devices from Ransomware attacks. This research provides novel insights into the IR in healthcare through embedding CTI advisories into IR processes and concludes that our proposed IR procedure can be used to counteract WannaCry Ransomware using CTI advisories. It has the significance of transforming the way of IR from reactive to proactive using the CTI in healthcare.

The continuous improvement of the cyber threat intelligence sharing mechanism provides new ideas to deal with Advanced Persistent Threats (APT). Extracting attack behaviors, i.e., Tactics, Techniques, Procedures (TTP) from Cyber Threat Intelligence (CTI) can facilitate APT actors’ profiling for an immediate response. However, it is difficult for traditional manual methods to analyze attack behaviors from cyber threat intelligence due to its heterogeneous nature. Based on the Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) of threat behavior description, this paper proposes a threat behavioral knowledge extraction framework that integrates Heterogeneous Text Network (HTN) and Graph Convolutional Network (GCN) to solve this issue. It leverages the hierarchical correlation relationships of attack techniques and tactics in the ATT&CK to construct a text network of heterogeneous cyber threat intelligence. With the help of the Bidirectional Encoder Representation from Transformers (BERT) pretraining model to analyze the contextual semantics of cyber threat intelligence, the task of threat behavior identification is transformed into a text classification task, which automatically extracts attack behavior in CTI, then identifies the malware and advanced threat actors. The experimental results show that F1 achieve 94.86% and 92.15% for the multi-label classification tasks of tactics and techniques. Extend the experiment to verify the method’s effectiveness in identifying the malware and threat actors in APT attacks. The F1 for malware and advanced threat actors identification task reached 98.45% and 99.48%, which are better than the benchmark model in the experiment and achieve state of the art. The model can effectively model threat intelligence text data and acquire knowledge and experience migration by correlating implied features with a priori knowledge to compensate for insufficient sample data and improve the classification performance and recognition ability of threat behavior in text.

The volumes and sophistication of cyber threats in today’s cyber threat landscape have risen to levels where automated quantitative tools for Cyber Threat Intelligence (CTI) have become an indispensable part in the cyber defense arsenals. The AI and cyber security research communities are producing novel automated tools for CTI that quickly find their ways into commercial products. However, the quality of such automated intelligence products is being questioned by the intelligence community. Cyber security operators are forced to complement the automated tools with costly and time-consuming human intelligence analysis in order to improve the quality of the end product. For improving the quality, it has been suggested that researchers should incorporate methods from traditional intelligence analysis into the quantitative algorithms. This article presents a novel approach to cyber intelligence analysis called AMBARGO, which takes the inherent ambiguity of evidence into account in the analysis, using the Choquet integral, in formalizing the re-evaluation of evidence and hypotheses made by human analysts. The development of AMBARGO revolves around a cyber attribution use case, one of the hardest problems in CTI. The results of our evaluating experiments show that the robustness of AMBARGO outperforms state-of-the-art quantitative approaches to CTI in the presence of ambiguous evidence and potentially deceptive threat actor tactics. AMBARGO has thus the potential to fill a gap in the CTI state-of-the-art, which currently handles ambiguity poorly. The findings are also confirmed in a large-scale realistic experimental setting based on data from an APT campaign obtained from the MITRE ATT&CK Framework.

In recent years, cyber attacks have consistently grown in terms of volume, sophistication, coordination, and pervasiveness. Such attacks impose billions of dollars loss to companies and government entities annually. Sharing cyber threat intelligence (CTI) about ongoing attacks can significantly improve the current situation as many cyber attackers tend to reuse or share their network infrastructure, techniques, tactics, and procedures across multiple attacks. Therefore, many security professionals devote their time and effort on hunting cyber threats and sharing such valuable information with the public through public data sharing platforms such as social media and text sharing websites. However, due to the sheer volume of information that is being shared on such platforms; finding CTI information is tantamount to looking for a needle in a haystack. In this paper, we present a new scalable framework, IoCMiner, to automatically extract CTI, in special Indicators of Compromise, from Twitter. It utilizes a combination of graph theory, machine learning, and text mining technique to achieve its goal. IoCMiner relies on a reputation model to discover credible twitterers who publish CTI, and only tracks the tweet stream of such Twitter handles. Moreover, it employs a CTI classifier to further filter out non-CTI tweets from the observed data streams. Finally, IoCs uses a set of regular expression rules to extract IoCs from the identifies tweets. Through experimentation, we show the usefulness of IoCMiner in finding fresh IoCs from Twitter. In the course of four weeks, IoCMiner identified more than 1,200 IoCs, including malicious URLs. Only 10% of the URLs were already listed in public blacklist databases at the time of extraction. The number of URLs that appeared in blacklists increased to 26% after one week.

The increasing complexity and scale of cyber threats have pushed Cyber Threat Intelligence (CTI) beyond the capabilities of traditional rule-based systems. This article explores how Artificial Intelligence (AI), particularly Machine Learning (ML), Deep Learning (DL), Natural Language Processing (NLP), and graph-based analytics, is reshaping the CTI landscape. By automating threat data processing, enhancing attribution, and enabling predictive capabilities, AI is transforming CTI into a proactive and scalable discipline. By analysing CTI architectures, real-world use cases, platform comparisons, and current limitations, this study highlights the emerging opportunities and challenges at the intersection of cybersecurity and AI. This analysis concludes that the future of CTI lies in hybrid systems that seamlessly combine human expertise with intelligent automation.

Cyber Threat Intelligence (CTI) plays a crucial role in cybersecurity risk management, providing valuable insights to organisations for threat identification and mitigation. The continuous and rapid increase of CTI volume, velocity, and variety requires a systematic approach to assessing their quality, operational significance, and actionable contribution. Threat Intelligence Platforms (TIPs) underpin the sharing and analysis of CTI, enabling organisations to collaborate and enhance their defensive measures ensuring the intelligence shared is effective and reliable for mitigating cyber threats. The assessment of CTI demands a detailed and comprehensive consideration of various factors addressing important quality and operational properties, such as their extensive approach, accuracy, timeliness, and standardisation. Drawing upon the MISP data model, this study defines quantifiable quality metrics based on simple mathematical equations. In addition, this study defines 2 approaches for weighting those criteria based on a subjective (fuzzy-Analytic Hierarchy Process) and an objective (Entropy-based) approach. Current CTI evaluation practices either lack standardized, comprehensive and quantifiable quality metrics or fail to balance subjective expert judgment with objective data variability. Moreover, existing models rarely integrate with operational platforms, limiting their practical applicability. This study addresses these gaps by proposing a framework that formally defines quality metrics, applies dual weighting mechanisms, and supports prioritization directly within a TIP context. By integrating quantifiable quality equations based on the MISP data model with diverse weighting approaches, this proposal enables researchers and practitioners to systematically assess and prioritize trustworthy, high-quality CTI. The dual weighting strategy allows organizations to flexibly adapt evaluations either to subjective expert-driven priority settings, or to objective, data-driven ones, depending on operational needs and available contextual knowledge. This approach facilitates informed decision-making, enhancing the organisation’s cybersecurity posture and resilience against evolving threats. This paper illustrates the potential of the proposed approach as well as demonstrates its benefits by implementing a proof of concept technical implementation on real Open Source Intelligence data, showcasing its utility in underpinning cybersecurity measures and facilitating threat response strategies.

In today’s world, cyber-attacks are becoming more frequent and thus proactive protection against them is becoming more important. Cyber Threat Intelligence (CTI) is a possible solution, as it collects threat information in various information sources and derives stakeholder intelligence to protect one’s infrastructure. The current focus of CTI in research is the clear web, but the dark web may contain further information. To further advance protection, this work analyzes the dark web as Open Source Intelligence (OSINT) data source to complement current CTI information. The underlying assumption is that hackers use the dark web to exchange, develop, and share information and assets. This work aims to understand the structure of the dark web and identify the amount of its openly available CTI related information. We conducted a comprehensive literature review for dark web research and CTI. To follow this up we manually investigated and analyzed 65 dark web forum (DWF), 7 single-vendor shops, and 72 dark web marketplace (DWM). We documented the content and relevance of DWFs and DWMs for CTI, as well as challenges during the extraction and provide mitigations. During our investigation we identified IT security relevant information in both DWFs and DWMs, ranging from malware toolboxes to hacking-as-a-service. One of the most present challenges during our manual analysis were necessary interactions to access information and anti-crawling measures, i.e., CAPTCHAs. This analysis showed 88% of marketplaces and 53% of forums contained relevant data. Our complementary semi-automated analysis of 1 186 906 onion addresses indicates, that the necessary interaction makes it difficult to see the dark web as an open, but rather treat it as specialized information source, when clear web information does not suffice.

Many organizations are continually put in danger by sophisticated and malevolent cyber attacks in today's rapidly developing threat landscape, which is evolving at a rapid rate. Cybercriminals, who are more skilled, more organized, and have more financial resources than in the past. Cyber Threat Intelligence, abbreviated as CTI, has emerged as a popular topic and is now being considered by many organizations as a potential solution to the growing number of cyber attacks. The purpose of this work is to conduct a literature review on the previous research that has been done on CTI. The most fundamental question about what CTI is investigated through the process of doing a literature study. This is done by contrasting several definitions in order to identify areas of agreement and disagreement. It has been discovered that neither the organization nor the suppliers have a comprehensive grasp of the information that is deemed to be CTI; hence, further study is required in order to define CTI. This article also listed existing CTI products and services, including as threat intelligence data feeds, threat intelligence standards, and tools that are being utilized in CTI. This study outlines four research issues in cyber threat intelligence and assesses contemporary work carried out in each of those areas. These difficulties were determined based on an assessment of the CTI definition, standards, and technologies. When an organization is inundated with a massive amount of threat data, the need for trained threat data analysts who are able to fully utilize CTI and transform the data into actionable information becomes more vital than it has ever been before. The problem of poor data quality is not a recent development; nonetheless, because to the increasing use of CTI, further study in this field is required.

BFLS: Blockchain and Federated Learning for sharing threat detection models as Cyber Threat Intelligence

Security analysts prepare threat analysis upon investigating an attack, an emerging cyber threat, or a recently discovered vulnerability. Threat intelligence on malware attacks and campaigns is shared on blog posts, reports, analyses, and tweets with varying technical details. Other security analysts use this intelligence to inform them of emerging threats, indicators of compromise, attack methods, and preventative measures. Collectively known as threat intelligence, it is typically in an unstructured format and, therefore, challenging to integrate seamlessly into existing IDPS systems. In this paper, we propose a framework that aggregates and combines CTI - the openly available cyber threat intelligence information. The information is extracted and stored in a structured format using knowledge graphs such that the semantics of the threat intelligence can be preserved and shared at scale with other security analysts. We propose the first semi-supervised open-source knowledge graph (KG) framework, TINKER, to capture cyber threat information and its context. Following TINKER, we generate a Cyberthreat Intelligence Knowledge Graph (CTI-KG). We demonstrate the efficacy of CTI-KG using different use cases and its application for security analysts.