Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper conducts a comprehensive literature survey on Cyber Threat Intelligence (CTI), identifying a significant gap in the academic focus on the CTI Generation and Sharing stage. Through practitioner interviews, it reveals that this stage is characterized by manual processes and recurring challenges, such as sensitive information exposure and data normalization. Pilot studies demonstrate that while Large Language Models (LLMs) can assist in the CTI Generation and Sharing process, they require expert supervision due to limitations in recovering indicators and grounding claims in evidence.
Despite the promise of LLMs, they only recover a fraction of indicators in CTI generation, highlighting the need for expert oversight in automated intelligence production.
Cyber Threat Intelligence (CTI) is essential for defending mission-critical infrastructure, yet the process of transforming raw attack evidence into shareable CTI remains fragmented and understudied. We conduct a literature survey of academic papers, organizing the CTI lifecycle into three stages: Threat Data Collection, CTI Generation and Sharing, and CTI Consumption. The first and third stages are well represented in the literature, whereas only a small number of papers address CTI Generation and Sharing. To learn how this stage is practiced, we survey practitioners across multiple organizations who routinely generate and share CTI. They describe a largely manual process with four recurring challenges: preventing the exposure of sensitive information, extracting indicators from noisy attack data, correlating observed behavior with standardized tactics, techniques, and procedures (TTPs), and translating CTI into the formats that sharing platforms require. Using the insights from the practitioner survey, we divide the CTI Generation and Sharing stage into four steps: Intelligence Extraction, Normalization and Enrichment, Codification, and Distribution. We then conduct pilot studies that probe the feasibility of current Large Language Models (LLMs) for each step. The pilot studies show that LLMs can assist an analyst in each of the four steps. However, the models recover only a fraction of the indicators the evidence contains, struggle to ground every claim in the supplied evidence, and do not judge what keeps shared intelligence useful to its recipients. Each step therefore requires expert supervision. Based on these observations, we derive three research directions for automating the production of shareable intelligence.