DisCTI: Who Needs to Know Timely? Automated Sector-Aware Cyber Threat Intelligence Dissemination
Cryptography and SecurityComputation and Language
Summary
The authors point out that sharing cyber threat information quickly and accurately helps organizations stop attacks faster, but current systems don’t organize the information by industry sector well. They created a new dataset with labeled cyber threat events sorted by sectors like energy or finance. Using a deep learning model called BERT, they taught a computer to automatically classify these events by sector with high accuracy. Their work shows that combining expert knowledge with machine learning can improve how companies receive relevant threat warnings for their specific industry.
Cyber Threat Intelligence (CTI)Sector TaggingMultilabel ClassificationBERTTransformer ModelSTIX FormatMalware Information Sharing Platform (MISP)Hamming LossMacro-averaged F1-scoreThreat Intelligence Platform (TIP)
Authors
Fajar Wijitrisnanto, Alsharif Abuadbba, Yansong Gao, Nan Wu
Abstract
The timely dissemination of cyber threat intelligence (CTI) is critical for organizations to mount swift and effective incident response. When valid CTI is delivered to the right sector at the right time, identical attacks can often be contained or mitigated. However, today's rapidly expanding CTI landscape overwhelms analysts, who must sift through massive and heterogeneous feeds. Existing platforms such as the Malware Information Sharing Platform (MISP) provide sector tagging features (e.g., energy, finance, government), but in practice, these remain largely unmapped (98% of events are left uncategorized). This lack of automated and timely sector mapping severely limits the operational value of shared intelligence, leaving organizations that belong especially to the critical information infrastructure sector exposed. To address this gap, we formulate sector-targeted CTI dissemination as a multilabel classification problem. Leveraging deep field knowledge of CTI structures and sector-specific threat patterns, we construct a novel data set of 872 sector-labelled CTI events from a threat intelligence platform (TIP). We then apply BERT, a transformer-based model, to automate the mapping of CTI events to sectors. Using the structured threat information expression (STIX) format for cross-platform interoperability, our approach achieves a macro-averaged F1-score of 0.89 at a Hamming loss of 0.055 on the custom dataset, i.e. 94.5% of individual sector-label assignments are correct. These results not only demonstrate the feasibility of sector-aware, automated CTI dissemination but also highlight how embedding expert field knowledge into machine learning design fills a crucial gap in the threat intelligence pipeline, enabling faster and context-relevant defensive action.