Pith. sign in

REVIEW 4 major objections 5 minor 45 references

A Threat Intelligence Event Extraction Conceptual Model for Cyber Threat Intelligence Feeds

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proposes a conceptual model, XBC, that stacks XLM-RoBERTa, BiGRU, and CRF to extract threat events from multilingual cyber threat intelligence feeds, addressing a gap left by a Chinese-only baseline.

desk verdict A transparent but small PRISMA review plus an unvalidated model swap; the central claim rides on a probing study, not on any CTI experiment. read the letter →

arxiv 2506.03551 v1 pith:6HA7UHDA submitted 2025-06-04 cs.CR

Jamal H. Al-Yasiri , Mohamad Fadli Bin Zolkipli , Nik Fatinah N Mohd Farid , Mohammed Alsamman , Zainab Ali Mohammed This is my paper
classification cs.CR
keywords cyberthreatintelligenceeventextractionmultilingualNLPXLM-RoBERTaBiGRUCRFPRISMAreviewfeeds
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that cyber threat intelligence (CTI) event extraction is held back by the difficulty of preprocessing large, multilingual threat feeds, and that the gap can be closed with a single named architecture, XBC, that stacks XLM-RoBERTa, BiGRU, and CRF. A sympathetic reader should care because threat reports arrive in many languages, while the closest prior model in the reviewed literature was demonstrated only on Chinese data. To ground the proposal, the paper runs a systematic review of ten studies and groups their methods into detection, classification, and context-specific improvements. The paper's central claim is that XBC will improve the accuracy and speed of multilingual CTI event extraction by combining cross-lingual embeddings, sequence modeling, and structured prediction in one joint extraction mechanism. The contribution is conceptual: no training set, training run, or evaluation against baselines is reported.

What carries the argument

The load-bearing object is the XBC model architecture: XLM-RoBERTa, a multilingual transformer that produces contextual embeddings for text in many languages; BiGRU, a bidirectional gated recurrent unit that models token sequences; and CRF, a conditional random field that predicts structured label sequences such as entities, events, and tactics, techniques, and procedures (TTPs) while respecting dependencies between labels. The paper binds them into a joint extraction mechanism intended to combine XLM-RoBERTa's cross-lingual representations, BiGRU's sequence modeling, and CRF's structured prediction so that events can be extracted from mixed-language threat feeds in one pass. The supporting machinery is the preprocessing pipeline (language detection, normalization, tokenization, lemmatization, stemming, and named entity recognition) that cleans text before training and fine-tuning.

What would settle it

Run the XBC stack and a simpler baseline, for example XLM-RoBERTa with a linear classifier or BiGRU-CRF without XLM-RoBERTa, on a multilingual CTI event extraction dataset containing English, Chinese, and Arabic threat reports, and compare F1 scores per language; if XBC does not beat the best baseline on non-English languages, the central claim is not supported.

Watch

Extended reading notes

Core claim

The central claim is that the proposed XBC model—XLM-RoBERTa for multilingual contextual embeddings, a bidirectional gated recurrent unit (BiGRU) for sequence modeling, and a conditional random field (CRF) for structured prediction—will perform event and TTP extraction from multilingual CTI feeds more accurately and faster than current single-language approaches. The paper positions this as the direct extension of a BERT-BiGRU-CRF APT event extraction model that was demonstrated only on Chinese data, and it cites evidence that XLM-RoBERTa learns strong multilingual representations as the reason the same architecture can generalize across languages. The model is specified as a pipeline: collection of multilingual threat text from security-focused social media, hacker forums, and a national CERT; language detection, normalization, tokenization, lemmatization, and named entity recognition; and fine-tuning of the joint XBC stack with data augmentation. The paper does not report implementation or results, so the claim is a proposal about what this architecture should accomplish.

Load-bearing premise

The proposal stands or falls on the assumption that XLM-RoBERTa's multilingual language abilities, which were shown on general linguistic tasks, transfer to cyber threat intelligence texts when combined with BiGRU and CRF, and that this stack outperforms simpler alternatives on that task.

Editorial extensions

If this is right

  • If XBC works as proposed, one pipeline could extract threat actors, indicators, techniques, and events from CTI feeds in multiple languages without language-specific retraining.
  • Security operations could consume non-English threat reports, including forum posts, CERT alerts, and social media content, that current pipelines drop or ignore.
  • TTP classification could be performed jointly with event extraction, so downstream systems receive structured, linked threat intelligence rather than raw text.
  • The preprocessing design gives a concrete template for building a multilingual CTI dataset, which is currently missing from the reviewed literature.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If XBC is validated, the same joint extraction pattern could transfer to adjacent security NLP tasks such as phishing email entity extraction or malware report triage, since those tasks share the same entity-and-event structure.
  • A testable extension would be ablating the BiGRU and CRF layers one at a time to measure their marginal contribution over a fine-tuned XLM-RoBERTa baseline; the paper does not state which component carries the improvement.
  • Because CTI terminology is likely rare in XLM-RoBERTa's pretraining corpus, domain-adaptive pretraining on security text may be needed before the multilingual advantage appears; this is an inference, not a paper claim.
  • The model's claimed speed advantage is unquantified; a concrete speed benchmark against a single-language pipeline on streaming feeds would settle that part of the proposal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper reports a PRISMA-guided review of ten Scopus-indexed studies on AI/ML techniques for improving Cyber Threat Intelligence (CTI) collection efficiency, and then proposes a conceptual model, XBC, that integrates XLM-RoBERTa, BiGRU, and CRF to address an identified gap: the monolingual limitation of a prior BERT-BiGRU-CRF APT event extraction system. The proposed pipeline is described textually and with a flow diagram, but no implementation, dataset, training, or evaluation is presented. The central contribution is thus an unvalidated architecture proposal combined with a small, post hoc-filtered literature review.

Significance. If the XBC model were implemented and shown to outperform monolingual baselines across languages, it would be a useful engineering contribution to multilingual CTI event extraction. The paper correctly identifies a real practical gap (multilingual CTI processing) and gives a clear architectural sketch. However, the manuscript currently offers no evidence that the proposed stack works: no event schema, no dataset, no baselines, and no empirical or analytical justification for the transfer of XLM-RoBERTa representations to CTI-specific entities. The review component is likewise limited by a small, non-transparently filtered evidence base. The paper's value at present is therefore largely motivational rather than evidential.

major comments (4)
  1. [Section V (Proposed Work)] The central claim—that XBC, integrating XLM-RoBERTa with BiGRU and CRF, will improve multilingual CTI event extraction—is unsupported by any implementation or evaluation. The only cited support, Acs et al. [45], concerns morphosyntactic probing of multilingual BERT models and does not demonstrate transfer to CTI event extraction, where domain terminology (malware names, APT groups, indicators) may be sparse in pretraining. The manuscript does not define an event label schema, a training objective (it alternates between TTP classification and NER), or an evaluation corpus, so the proposed model is not falsifiable as described. The abstract and introduction assert that XBC 'will improve' accuracy and speed, but this is an empirical hypothesis stated as a conclusion.
  2. [Section II (Methodology)] The PRISMA-based review applies substantial exclusion criteria after the fact and without pre-specified rules: non-open-access papers are removed (85 articles), as are Q3-ranked journals, conference papers with low H-index, interview/survey studies, and review papers. These are post hoc, partly subjective filters (e.g., 'All papers that not highly ranked were excluded'), so the resulting ten-paper evidence base cannot support the paper's general conclusions about current techniques. A systematic review requires transparent, pre-defined inclusion/exclusion criteria and preferably dual screening; as reported, the selection is not reproducible.
  3. [Table II and Section IV] Table II aggregates accuracy values from heterogeneous datasets and tasks (e.g., APT event extraction on Chinese data, IoT URL prediction, intrusion detection on 11 datasets), yet the discussion compares these numbers as if they were comparable. Xiang et al.'s BERT-BiGRU-CRF value of 70.1% is the only result directly relevant to the proposed XBC model, and it is from a monolingual Chinese dataset. There is no quantitative argument that substituting XLM-RoBERTa for BERT would raise this figure or transfer across languages; the gap statement in Section IV therefore rests on an untested assumption.
  4. [Section V (Data preprocessing)] The proposed pipeline is under-specified: it performs lemmatization with SpaCy, later removes stopwords and stems with NLTK, and applies NER before stopping, but the order of these steps is inconsistent and the relationship between the NER entities and the later TTP classification objective is not described. The description of 'joint extraction mechanism' for combining XLM-RoBERTa, BiGRU, and CRF is too vague to replicate (e.g., how the CRF is fed by the BiGRU layer, and whether the model optimizes one loss or multiple). A conceptual model can be high-level, but the core mechanism whose benefit is claimed needs enough detail to be implemented.
minor comments (5)
  1. [Throughout] There are numerous typographical and grammatical errors that impede reading, including 'Literature Rivew' (Section III heading), 'interating' (Section V), 'humen', 'ragne', 'eo enshure', and 'especilly'.
  2. [Section IV, Figures 6 and 7] The text refers to 'Figure.6 shows how frequently these algorithm has been used', but Figure 6 depicts research methodology proportions; the algorithm frequency appears in Figure 7. The figure references need correction.
  3. [References] Reference numbering appears inconsistent: the text says 'Asiri [21] ... investigated coping strategies for mobile malware', but reference [21] is Asiri et al.'s paper on indicators of compromise; the coping-strategies paper is Xin et al. [20]. Similarly, Xin [20] is listed among excluded review papers, although the cited title is a research article.
  4. [Table I and Table II] Table I's column headers ('No Quar. Cited by Year') are unclear; 'Quar.' should be defined (quartile?), and column 1 presumably is the article number but is not labeled. Table II's column numbers should refer to a legend, and missing values should be explicitly marked rather than implied by dashes.
  5. [References] The reference list contains incomplete entries for conference papers (e.g., [7]–[10]) that lack titles and page numbers; these should be completed.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the XBC proposal is an asserted conceptual design with no fitted inputs or self-citation chain; its weakness is lack of validation, not circular reasoning.

full rationale

This paper makes no fitted predictions and performs no derivation from data. The proposed XBC model is a conceptual pipeline (data collection, preprocessing, XLM-RoBERTa+BiGRU+CRF training) that is asserted to address multilingual CTI event extraction. The only cited support for XLM-RoBERTa's multilingual competence is Acs et al. [45], an external probing study not authored by the present authors and not stating the target result. The paper reports predecessor accuracies from Xiang et al. [2] (BERT 58%, BERT-BiGRU-CRF 70.1%) but does not fit any parameter to those numbers or predict them from the model; Table II is a literature summary, not a fitted output. There is no equation by which the model output reduces to an input, no self-citation chain, and no renaming of an empirical pattern as an organizational scheme. The central weakness is an unvalidated empirical hypothesis presented as a contribution, which is a support gap (correctness risk), not circularity. Thus score 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper contributes a conceptual pipeline assembled from existing components; it introduces no free parameters or invented physical entities, but it relies on several domain assumptions about transferability and about the representativeness of its Scopus-only, post-hoc-filtered review corpus.

assumptions (4)
  • domain assumption The Scopus search query and keyword set are sufficient to capture the relevant CTI collection-efficiency literature.
    The entire literature synthesis rests on this query; no validation against other databases such as IEEE Xplore, ACM DL, or Web of Science is given.
  • domain assumption XLM-RoBERTa's multilingual representations, as shown by Acs et al. in morphosyntactic probing, will support CTI event extraction in multiple languages.
    Invoked in Section V to justify replacing BERT with XLM-RoBERTa; no CTI-specific evidence is presented.
  • domain assumption The BERT-BiGRU-CRF architecture of Xiang et al. is an effective base that remains effective when its encoder is swapped for XLM-RoBERTa.
    The paper proposes the architecture in Section V as a direct multilingual version of Xiang's model without ablations.
  • domain assumption Event extraction performance can be inferred from accuracy values reported across heterogeneous tasks and datasets.
    Table II mixes accuracy numbers from different tasks, URL detection, intrusion detection, APT extraction, and treats them as comparable evidence for CTI collection efficiency, discussed in Section IV.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Threat Intelligence Event Extraction Conceptual Model for Cyber Threat Intelligence Feeds." pith.science (2026). https://pith.science/paper/6HA7UHDA

@misc{pith2026250603551,
  author       = {Pith},
  title        = {Pith review of: A Threat Intelligence Event Extraction Conceptual Model for Cyber Threat Intelligence Feeds},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6HA7UHDA}},
  note         = {Machine review of arXiv:2506.03551}
}
read the original abstract

In response to the escalating cyber threats, the efficiency of Cyber Threat Intelligence (CTI) data collection has become paramount in ensuring robust cybersecurity. However, existing works encounter significant challenges in preprocessing large volumes of multilingual threat data, leading to inefficiencies in real-time threat analysis. This paper presents a systematic review of current techniques aimed at enhancing CTI data collection efficiency. Additionally, it proposes a conceptual model to further advance the effectiveness of threat intelligence feeds. Following the PRISMA guidelines, the review examines relevant studies from the Scopus database, highlighting the critical role of artificial intelligence (AI) and machine learning models in optimizing CTI data preprocessing. The findings underscore the importance of AI-driven methods, particularly supervised and unsupervised learning, in significantly improving the accuracy of threat detection and event extraction, thereby strengthening cybersecurity. Furthermore, the study identifies a gap in the existing research and introduces XBC conceptual model integrating XLM-RoBERTa, BiGRU, and CRF, specifically developed to address this gap. This paper contributes conceptually to the field by providing a detailed analysis of current CTI data collection techniques and introducing an innovative conceptual model to enhance future threat intelligence capabilities.

Figures

Figures reproduced from arXiv: 2506.03551 by the authors.

Figure 1
Figure 1. PRISMA flow diagram 2020 paper were six. The result for automatic filtering is forty￾four papers. All papers belongs to the subject of computer science and also some of them belong to other subjects at the same time, for example 25 research lies in Engineering and 9 in Materials Science as shown in Figure.2. In the term or document types and as shown in Figure.3, 86% of them are Article but only about 14% are Confer… view at source ↗
Figure 2
Figure 2. Document distribution by subject area [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Document distribution by type [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Document count by year [PITH_FULL_IMAGE:figures/full_fig_p003_4.png]
Figure 5
Figure 5. Figure 5: Timeline of documents publications by year and source [PITH_FULL_IMAGE:figures/full_fig_p003_5.png]
Figure 6
Figure 6. Figure 6: Proportional usage of research methodologies in the related [PITH_FULL_IMAGE:figures/full_fig_p004_6.png]
Figure 7
Figure 7. Figure 7: Proportional distribution of algorithm types in related papers [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 8
Figure 8. Figure 8: XBC Model’s flow chart The review identifies a gap in existing research, particularly in processing multilingual threat data. To address this, the authors proposed the XBC conceptual model, aimed at enhancing efficiency through multilingual preprocessing techniques. In…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

45 extracted references · 45 canonical work pages

  1. [45]

    Mor- phosyntactic probing of multilingual bert models,

    J. Acs, E. Hamerlik, R. Schwartz, N. A. Smith, and A. Kornai, “Mor- phosyntactic probing of multilingual bert models,”Natural Language Engineering, vol. 1, no. 1, 2023

    work page 2023

  2. [1]

    Sharing machine learning models as indicators of compromise for cyber threat intelligence,

    D. Preuveneers and W. Joosen, “Sharing machine learning models as indicators of compromise for cyber threat intelligence,”Journal of Cybersecurity and Privacy, vol. 1, no. 1, p. 140 – 163, 2021

    work page 2021

  3. [2]

    An apt event extraction method based on bert-bigru-crf for apt attack detection,

    G. Xiang, C. Shi, and Y. Zhang, “An apt event extraction method based on bert-bigru-crf for apt attack detection,”Electronics (Switzerland), vol. 12, no. 15, 2023

    work page 2023

  4. [3]

    Attack behavior extraction based on heterogeneous cyberthreat intelligence and graph convolutional networks,

    B. Tang, J. Wang, H. Qiu, J. Yu, Z. Yu, and S. Liu, “Attack behavior extraction based on heterogeneous cyberthreat intelligence and graph convolutional networks,”Computers, Materials and Continua, vol. 74, no. 1, p. 235 – 252, 2023

    work page 2023

  5. [4]

    Design of remote upgrade system for data processing unit in marine engine room simulator,

    H. Zeng, H. Liu, J. Zhang, M. Sun, and T. Wang, “Design of remote upgrade system for data processing unit in marine engine room simulator,” Applied Sciences (Switzerland), vol. 12, no. 18, 2022

    work page 2022

  6. [5]

    Improving the iot attack classification mecha- nism with data augmentation for generative adversarial networks,

    H.-C. Chu and Y.-J. Lin, “Improving the iot attack classification mecha- nism with data augmentation for generative adversarial networks,”Applied Sciences (Switzerland), vol. 13, no. 23, 2023

    work page 2023

  7. [6]

    Incorporating cyber threat intelligence into complex cyber-physical systems: A stix model for active buildings,

    R. M. Czekster, R. Metere, and C. Morisset, “Incorporating cyber threat intelligence into complex cyber-physical systems: A stix model for active buildings,”Applied Sciences (Switzerland), vol. 12, no. 10, 2022

    work page 2022

  8. [7]

    Authentication of iot device and iot server using security key

    W. Alnahari and M. T. Quasim, “Authentication of iot device and iot server using security key.” Institute of Electrical and Electronics Engineers Inc., 2021, Conference paper

    work page 2021

Show all 45 references
  1. [8]

    Semantic ranking for automated adversarial technique annotation in security text

    U. Kumarasinghe, A. Lekssays, H. T. Sencar, S. Boughorbel, C. Elvitigala, and P. Nakov, “Semantic ranking for automated adversarial technique annotation in security text.” Association for Computing Machinery, Inc, 2024, Conference paper, p. 49 – 62

    2024

  2. [9]

    Sok: The impact of unlabelled data in cyberthreat detection

    G. Apruzzese, P. Laskov, and A. Tastemirova, “Sok: The impact of unlabelled data in cyberthreat detection.” Institute of Electrical and Electronics Engineers Inc., 2022, Conference paper, p. 20 – 42

    2022

  3. [10]

    To ttp or not to ttp?: Exploiting ttps to improve ml-based malware detection

    Y. Sharma, E. Giunchiglia, S. Birnbach, and I. Martinovic, “To ttp or not to ttp?: Exploiting ttps to improve ml-based malware detection.” Institute of Electrical and Electronics Engineers Inc., 2023, Conference paper, p. 8 – 15

    2023

  4. [11]

    A multi-attribute approach for cyber threat intelligence product and services selection,

    A. V. Vevera, C. E. Cˆırnu, and C. Z. Radulescu, “A multi-attribute approach for cyber threat intelligence product and services selection,”Studies in Informatics and Control, vol. 31, no. 1, p. 13 – 23, 2022

    2022

  5. [12]

    Cyber-threat perception and risk management in the swedish financial sector,

    S. Varga, J. Brynielsson, and U. Franke, “Cyber-threat perception and risk management in the swedish financial sector,”Computers and Security, vol. 105, 2021

    2021

  6. [13]

    What s in a cyber threat intelligence sharing platform?

    B. Stojkovski, G. Lenzini, V. Koenig, and S. Rivas, “What s in a cyber threat intelligence sharing platform?” Association for Computing Machinery, 2021, Conference paper, p. 385 – 398

    2021

  7. [14]

    A review of state- of-the-art malware attack trends and defense mechanisms,

    J. Ferdous, R. Islam, A. Mahboubi, and M. Z. Islam, “A review of state- of-the-art malware attack trends and defense mechanisms,”IEEE Access, vol. 11, p. 121118 – 121141, 2023

    2023

  8. [15]

    A shared cyber threat intelligence solution for smes,

    M. van Haastrecht, G. Golpur, G. Tzismadia, R. Kab, C. Priboi, D. David, A. R ˘ac˘at˘aian, M. Brinkhuis, and M. Spruit, “A shared cyber threat intelligence solution for smes,”Electronics (Switzerland), vol. 10, no. 23, 2021

    2021

  9. [16]

    A systematic review on research utilising artificial intelligence for open source intelligence (osint) applications,

    T. O. Browne, M. Abedin, and M. J. M. Chowdhury, “A systematic review on research utilising artificial intelligence for open source intelligence (osint) applications,”International Journal of Information Security, vol. 23, no. 4, p. 2911 – 2938, 2024

    2024

  10. [17]

    Enhancing cyber-threat intelligence in the arab world: Leveraging ioc and misp integration,

    I. Y. Alzahrani, S. Lee, and K. Kim, “Enhancing cyber-threat intelligence in the arab world: Leveraging ioc and misp integration,”Electronics (Switzerland), vol. 13, no. 13, 2024

    2024

  11. [18]

    Ransomware detection using machine learning: A review, research limitations and future directions,

    J. Ispahany, M. R. Islam, M. Z. Islam, and M. A. Khan, “Ransomware detection using machine learning: A review, research limitations and future directions,”IEEE Access, vol. 12, p. 68785 – 68813, 2024

    2024

  12. [19]

    A methodology to evaluate standards and platforms within cyber threat intelligence,

    A. de Melo e Silva, J. J. C. Gondim, R. de Oliveira Albuquerque, and L. J. G. Villalba, “A methodology to evaluate standards and platforms within cyber threat intelligence,”Future Internet, vol. 12, no. 6, 2020

    2020

  13. [20]

    Understanding the inward emotion- focused coping strategies of individual users in response to mobile malware threats,

    T. Xin, M. Siponen, and S. Chen, “Understanding the inward emotion- focused coping strategies of individual users in response to mobile malware threats,”Behaviour and Information Technology, vol. 41, no. 13, p. 2835 – 2859, 2022

    2022

  14. [21]

    Understanding indicators of compromise against cyber-attacks in industrial control systems: A security perspective,

    M. Asiri, N. Saxena, R. Gjomemo, and P. Burnap, “Understanding indicators of compromise against cyber-attacks in industrial control systems: A security perspective,”ACM Transactions on Cyber-Physical Systems, vol. 7, no. 2, 2023

    2023

  15. [22]

    The need for cyber- security self-evaluation in healthcare,

    W. Burke, A. Stranieri, T. Oseni, and I. Gondal, “The need for cyber- security self-evaluation in healthcare,”BMC Medical Informatics and Decision Making, vol. 24, no. 1, 2024

    2024

  16. [23]

    Rama: a risk assessment solu- tion for healthcare organizations,

    M. Smyrlis, E. Floros, I. Basdekis, D.-B. Prelipcean, A. Sotiropoulos, H. Debar, A. Zarras, and G. Spanoudakis, “Rama: a risk assessment solu- tion for healthcare organizations,”International Journal of Information Security, vol. 23, no. 3, p. 1821 – 1838, 2024

    2024

  17. [24]

    Malware threat on edge/fog computing environments from internet of things devices perspective,

    I. Gulatas, H. H. Kilinc, A. H. Zaim, and M. A. Aydin, “Malware threat on edge/fog computing environments from internet of things devices perspective,”IEEE Access, vol. 11, p. 33584 – 33606, 2023

    2023

  18. [25]

    Interoperability challenges in the cybersecurity information sharing ecosystem,

    K. Rantos, A. Spyros, A. Papanikolaou, A. Kritsas, C. Ilioudis, and V. Katos, “Interoperability challenges in the cybersecurity information sharing ecosystem,”Computers, vol. 9, no. 1, 2020

    2020

  19. [26]

    Factors affecting corporate security policy effec- tiveness in telecommuting,

    C. Lee and K. Lee, “Factors affecting corporate security policy effec- tiveness in telecommuting,”Security and Communication Networks, vol. 2021, 2021

    2021

  20. [27]

    E2e-rds: Efficient end-to- end ransomware detection system based on static-based ml and vision- based dl approaches,

    I. Almomani, A. Alkhayer, and W. El-Shafai, “E2e-rds: Efficient end-to- end ransomware detection system based on static-based ml and vision- based dl approaches,”Sensors, vol. 23, no. 9, 2023

    2023

  21. [28]

    Distributed security framework for reliable threat intelligence sharing,

    D. Preuveneers, W. Joosen, J. Bernal Bernabe, and A. Skarmeta, “Distributed security framework for reliable threat intelligence sharing,” Security and Communication Networks, vol. 2020, 2020

    2020

  22. [29]

    A.-A. Bouramdane, “Cyberattacks in smart grids: Challenges and solving the multi-criteria decision-making for cybersecurity options, including ones that incorporate artificial intelligence, using an analytical hierarchy process,”Journal of Cybersecurity and Privacy, vol. 3, no...

    2023

  23. [30]

    Cyber threat: its origins and consequence and the use of qualitative and quantitative methods in cyber risk assessment,

    J. Crotty and E. Daniel, “Cyber threat: its origins and consequence and the use of qualitative and quantitative methods in cyber risk assessment,” Applied Computing and Informatics, 2022

    2022

  24. [31]

    Building collaborative cybersecurity for critical infrastructure protec- tion: Empirical evidence of collective intelligence information sharing dynamics on threatfox,

    E. Joll `es, S. Gillard, D. Percia David, M. Strohmeier, and A. Mermoud, “Building collaborative cybersecurity for critical infrastructure protec- tion: Empirical evidence of collective intelligence information sharing dynamics on threatfox,”Lecture Notes in Computer Science (...

    2023

  25. [32]

    Cutting-edge assets for trust in 5g and beyond: Requirements, state of the art, trends, and challenges,

    J. M. Jorquera Valero, P. M. S ´anchez S ´anchez, M. Gil P ´erez, A. Huer- tas Celdr ´an, and G. Martinez Perez, “Cutting-edge assets for trust in 5g and beyond: Requirements, state of the art, trends, and challenges,”ACM Computing Surveys, vol. 55, no. 11, 2023

    2023

  26. [33]

    Cyber threat intelligence framework for incident response in an energy cloud platform,

    S. Gong and C. Lee, “Cyber threat intelligence framework for incident response in an energy cloud platform,”Electronics (Switzerland), vol. 10, no. 3, p. 1 – 19, 2021

    2021

  27. [34]

    A reference model for cyber threat intelligence (cti) systems,

    G. Sakellariou, P. Fouliras, I. Mavridis, and P. Sarigiannidis, “A reference model for cyber threat intelligence (cti) systems,”Electronics (Switzer- land), vol. 11, no. 9, 2022

    2022

  28. [35]

    Automatic decision tree-based nidps ruleset generation for dos/ddos attacks,

    A. Coscia, V. Dentamaro, S. Galantucci, A. Maci, and G. Pirlo, “Automatic decision tree-based nidps ruleset generation for dos/ddos attacks,”Journal of Information Security and Applications, vol. 82, 2024

    2024

  29. [36]

    Blockchain- based cyber threat intelligence sharing using proof-of-quality consensus,

    D. Chatziamanetoglou, K. Rantos, and A. Michienzi, “Blockchain- based cyber threat intelligence sharing using proof-of-quality consensus,” Security and Communication Networks, vol. 2023, 2023

    2023

  30. [37]

    Which algorithm can detect unknown attacks? comparison of supervised, unsupervised and meta-learning algorithms for intrusion detection,

    T. Zoppi, A. Ceccarelli, T. Puccetti, and A. Bondavalli, “Which algorithm can detect unknown attacks? comparison of supervised, unsupervised and meta-learning algorithms for intrusion detection,”Computers and Security, vol. 127, 2023

    2023

  31. [38]

    Securing smart cities through machine learning: A honeypot-driven approach to attack detection in internet of things ecosystems,

    Y. Ahmed, K. Beyioku, and M. Yousefi, “Securing smart cities through machine learning: A honeypot-driven approach to attack detection in internet of things ecosystems,”IET Smart Cities, 2024

    2024

  32. [39]

    Malgra: Machine learning and n-gram malware feature extraction and detection system,

    M. Ali, S. Shiaeles, G. Bendiab, and B. Ghita, “Malgra: Machine learning and n-gram malware feature extraction and detection system,”Electronics (Switzerland), vol. 9, no. 11, p. 1 – 20, 2020

    2020

  33. [40]

    Enhancing cyber-resilience for small and medium-sized organizations with prescriptive malware analysis, detection and response,

    L. F. Ilca, O. P. Lucian, and T. C. Balan, “Enhancing cyber-resilience for small and medium-sized organizations with prescriptive malware analysis, detection and response,”Sensors, vol. 23, no. 15, 2023

    2023

  34. [41]

    Enhancing cyber threat identification in open-source intelligence feeds through an improved semi-supervised generative adversarial learning approach with contrastive learning,

    O. Cherqi, Y. Moukafih, M. Ghogho, and H. Benbrahim, “Enhancing cyber threat identification in open-source intelligence feeds through an improved semi-supervised generative adversarial learning approach with contrastive learning,”IEEE Access, vol. 11, p. 84440 – 84452, 2023

    2023

  35. [42]

    Comparative experiment on ttp classification with class imbalance using oversampling from cti dataset,

    H. Kim and H. Kim, “Comparative experiment on ttp classification with class imbalance using oversampling from cti dataset,”Security and Communication Networks, vol. 2022, 2022

    2022

  36. [43]

    Anomaly detection in cybersecurity datasets via cooperative co- evolution-based feature selection,

    A. Bazlur Rashid, M. Ahmed, L. F. Sikos, and P. Haskell-Dowland, “Anomaly detection in cybersecurity datasets via cooperative co- evolution-based feature selection,”ACM Transactions on Management Information Systems, vol. 13, no. 3, 2022

    2022

  37. [44]

    An efficient hybrid feature selection technique toward prediction of suspicious urls in iot environment,

    S. Mohanty, A. A. Acharya, T. Gaber, N. Panda, E. Eldesouky, and I. A. Hameed, “An efficient hybrid feature selection technique toward prediction of suspicious urls in iot environment,”IEEE Access, vol. 12, p. 50578 – 50594, 2024

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.