Working with AI for threat intelligence

Having in mind that Steps 3 and 4 in the CTI life cycle are about processing and analysis of data, we can anticipate that some form of intelligent data analytics techniques are beneficial to obtain information from threat intelligence data. Open-source intelligence (OSINT) data sources, such as online publications, media, blogs, newspapers, and so on offer a large volume of mainly textual data that may contain useful information for cyber threat investigation. Having in mind the volume and variety of information, we could benefit from natural language processing (NLP) techniques and machine learning techniques to automate and accelerate information extraction.

There were multiple academic and industrial approaches to such information extraction. They are based on extracting topics or keywords related to cyber threats in general or to a specific topic of investigation. For instance, we could be investigating a particular vulnerability and attempting...