Processing Threat Reports at Scale Using AI and ML: Expectations and Reality
summary
An automated pipeline ingests ~50,000 reports and finds about 50,000 reports / 2,200 useful items, follows links to fetch PDFs/GitHub/CSVs, tokenizes with spaCy and regex, classifies into strategic / technical / field buckets using an XGBoost classifier, extracts entities (NER ~90–98.5% with ML), links objects via regex, vector models or LLMs, logs token usage to control costs, and outputs normalized STIX 2.1 output with artifacts and relationship mappings for analyst review.
AI-written summary · about
chapters (7)
- 0:00AI-driven threat report intro
- 3:57Classifying threat reports with ML
- 7:10Extracting entities from reports
- 13:06LLMs for name recognition
- 18:45ML vs LLM for threat intel
- 21:58Finding entity relationships
- 27:28Transforming reports to machine-readable
related talks
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
23mText analytics on annual reports
16mSoK: Automated TTP Extraction from CTI Reports – Are We There Yet?
22mMachine Learning–Driven Third-Party Risk Management at Scale
21mAutomating the Junior Analyst: Cyber Security Report Generation with Classic AI
40mApplying Artificial Intelligence to the Incident Response Function
28mSupercharging Threat Intelligence with AI
31mBuild threat detection models using ML