Death to the IOC: What's Next in Threat Intelligence
summary
Claims automated extraction of actor, malware and technique names from unstructured TI text using ML and a proof‑of‑concept web app that highlights entities in context. It trains on APTnotes (~2,700 docs) and threat blogs, compares a statistical CRF with embeddings and a stacked biLSTM LSTM, and finds LSTM scores highest on seen tokens while CRF+embeddings gives the best precision on unseen tokens. Demonstrates custom entity extraction, context sensitivity (avoids regex false positives), and produces TTP‑overlap graphs to drive defensive priorities.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:15About Padma
- 7:55Training Data
- 10:14IOB Style
- 11:18Word Embedding
- 12:04Word Embedding Example
- 12:38Word Embedding Visualization
- 14:31Conditional Random Fields
- 16:06LSDM
- 16:55Recall
- 17:36Precision
- 18:32Unseen Tokens
- 22:22Whats Next
- 24:10Open Questions
related talks
28mSupercharging Threat Intelligence with AI
16mSoK: Automated TTP Extraction from CTI Reports – Are We There Yet?
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
41mWhen Knowledge Graph Meets TTPs: Automated & Adaptive Executable TTP Intelligence for Security
23mData Driven APT Attribution and AI/ML Research
27mAgentic Cyber Defense with External Threat Intelligence
30mTrawling for IOCs: Catching C2 in a Sea of Data