A SoK for SoCs: Reading the TI Leaves on AI for Cyber Threat Intelligence Generation and Sharing

arXiv:2609.01174 · cs.CR · Submitted 2026-09-01 · Read on arXiv

cs.CR

Submitted: 2026-09-01

Updated: 2026-09-01

Code: https://github.com/kevoreilly/CAPEv2

Project page: https://weihang-wang.github.io/papers/mci_ndss18.pdf

Terminology

• Cyber Threat Intelligence — 30× in this paper
• Provenance — 26× in this paper · explained in 4 episodes
• Trace — 11× in this paper · explained in 2 episodes
• Actor — 6× in this paper · explained in 3 episodes
• Benchmark — 5× in this paper · explained in 2 episodes
• IEEE Symposium on Security and Privacy — 5× in this paper
• Knowledge Graph — 4× in this paper · explained in 7 episodes
• Annual Computer Security Applications Conference — 3× in this paper
• Graph Construction — 3× in this paper · explained in 3 episodes
• Representation Learning — 3× in this paper · explained in 2 episodes
• Aggregation — 2× in this paper · explained in 1 episode
• Common Platform Enumeration — 2× in this paper
• Common Weakness Enumeration — 2× in this paper
• Fidelity — 2× in this paper · explained in 2 episodes
• General Data Protection Regulation — 2× in this paper
• Grounding — 2× in this paper · explained in 3 episodes
• Large Language Models (LLMs) — 2× in this paper · explained in 6 episodes
• Active Learning — 1× in this paper · explained in 6 episodes
• Agentic Workflows — 1× in this paper · explained in 1 episode
• Alert Fatigue — 1× in this paper · explained in 1 episode
• Artificial Intelligence (AI) — 1× in this paper · explained in 2 episodes
• Common Attack Pattern Enumeration and Classification — 1× in this paper
• Common Vulnerabilities and Exposures — 1× in this paper
• Common Vulnerability Scoring System — 1× in this paper
• Core — 1× in this paper · explained in 2 episodes
• Explainability — 1× in this paper · explained in 3 episodes
• Feature Engineering — 1× in this paper · explained in 3 episodes
• Formal Methods — 1× in this paper · explained in 3 episodes
• International Conference on Intelligence and Security Informatics — 1× in this paper
• Knowledge graphs — 1× in this paper · explained in 2 episodes
• Ontology — 1× in this paper · explained in 2 episodes
• Steering — 1× in this paper · explained in 2 episodes
• Task Decomposition — 1× in this paper · explained in 2 episodes
• Transformer — 1× in this paper · explained in 2 episodes

Sources

• From Alerts to Intelligence: A Novel LLM-Aided Framework for Host-based Intrusion Detection
• Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild
• ThreatPilot: Attack-Driven Threat Intelligence Extraction
• Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports
• Cyber-Attack Technique Classification Using Two-Stage Trained Large Language Models

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs