Pith. sign in

REVIEW 3 major objections 7 minor 17 references

Fallible ATT&CK mappings can be stored as auditable claims and trusted only when explicit validation grounds say so.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-31 11:37 UTC pith:NTKFSJEZ

load-bearing objection Solid systems paper on post-extraction CTI claim governance; the lifecycle and conformance work hold up, the 90.6% precision headline is softer than it looks. the 3 major comments →

arxiv 2607.24563 v2 pith:NTKFSJEZ submitted 2026-07-27 cs.AI cs.CR

TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs

Federico Valletta , Giacomo Longo , Enrico Russo , Alessio Merlo This is my paper
classification cs.AI cs.CR
keywords cyber threat intelligenceknowledge graphslarge language modelsMITRE ATT&CKprovenanceauditabilityTTP extractionclaim governance
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Security teams increasingly auto-map threat reports to MITRE ATT&CK, but those model outputs are imperfect and often saved without the evidence, producer history, or validation trail needed to decide whether any single mapping should be trusted. This paper introduces TRACE-CTI, a post-extraction governance layer that keeps every run-level prediction, rolls them into configuration-level assertions, records cross-setup agreement as corroboration evidence, and exposes only assertions backed by policy-compliant validation. On 65 public reports and six heterogeneous extractor setups ingested into one versioned knowledge graph, the schema stays stable, provenance stays complete, and every trusted assertion has an active recorded ground. Tightening multi-setup support from any single setup to full six-setup unanimity lifts gold-aligned precision from about 25% to about 91% while cutting recall, and the graph can answer lifecycle questions a flat sentence–label store cannot. The point is not a better extractor; it is an explicit boundary between what a model predicted and what the system is prepared to treat as trusted intelligence.

Core claim

TRACE-CTI shows that heterogeneous TTP-extractor outputs can be governed in one schema-stable knowledge graph so that raw predictions remain untrusted by default, every trusted GraphAssertion is backed by an active recorded validation ground, provenance paths stay complete across successive graph versions, and stricter multi-setup corroboration selects a smaller, higher-precision set of evidence–technique claims while making provenance, trust, versioning, revocation dependency, disagreement, and review-queue questions directly answerable.

What carries the argument

The claim lifecycle: immutable run-level Predictions aggregate into configuration-level GraphAssertions; setup-deduplicated agreement becomes ConsensusAssertions used as corroboration evidence; a policy-derived trusted view admits only GraphAssertions with active gold, analyst, or multi-witness validation records, with append-only history and non-destructive revocation.

Load-bearing premise

That matching gold labels at the whole-document level, plus agreement among differently configured extractors under a fixed ingestion order, is enough to treat multi-setup support as a meaningful trust ground even though the setups are not shown to make independent errors.

What would settle it

At fixed support size and controlled same-family versus cross-family setup sets, multi-witness agreement fails to raise gold-aligned precision over single-setup or same-family baselines, or trusted-view membership appears without an active qualifying validation record after a real revocation or policy change.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • SOCs can keep every extractor output for audit without silently promoting it into operational CTI.
  • Trust thresholds become explicit policy knobs trading precision against recall rather than hidden confidence scores.
  • New extractors can be added without rewriting the schema or breaking older provenance paths.
  • If a setup or source is later found unreliable, dependent assertions can leave the trusted view while their history remains reconstructible.
  • Flat sentence–label stores need enrichment before they can answer the same provenance, version, dependency, and review questions.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same lifecycle pattern could apply to other fallible LLM extractions where predictions must not become facts by default, such as vulnerability mapping or incident summarization.
  • Once analyst review is exercised as a live validation source, review queues could be ranked by disagreement and witness diversity rather than raw model confidence alone.
  • Sharing platforms could ingest only the trusted view while the audit graph retains contested predictions upstream.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The manuscript presents TRACE-CTI, a post-extraction governance framework for TTP-extraction outputs. Run-level Predictions are preserved immutably in a versioned Neo4j knowledge graph, aggregated into configuration-level GraphAssertions ⟨e,a,c⟩, corroborated across setups via target-level ConsensusAssertions with setup-deduplicated witness counting, and exposed in a trusted view only when backed by an active, recorded validation ground (gold, analyst, or policy-compliant multi-witness). The evaluation ingests a controlled 2×3 retriever–generator matrix (six setups, 72 LLMRuns) over TRAM v2 and AnnoCTR (65 reports, 5,303 sentences) across six cumulative GraphVersions. The authors report: 100% provenance-path closure, zero schema delta, disjoint operational scopes, and zero trusted-view leakage (RQ1/RQ3); greater Jaccard output diversity for cross-generator-family pairs (0.433 vs 0.318) (RQ2); a document-level gold-aligned precision trajectory rising from 25.3% (k≥1) to 90.6% (six-setup unanimity) with recall falling 88.2%→16.3% (RQ3); and seven lifecycle queries answerable from the graph but not from a minimal flat store (RQ4). The authors are unusually careful to disclaim causal family effects, statistical independence, and the coarseness of document-level matching (§6.1.3, §7.3), and ship a public artifact with a hash-identified snapshot.

Significance. If the results hold, the paper makes a solid contribution to an under-served problem: the lifecycle of extractor outputs after generation. The Prediction/GraphAssertion/ConsensusAssertion separation, setup-deduplicated witness counting (RAG vs RAG+FSP and repeated seeds cannot inflate support), the append-only audit history with a non-monotonic trusted view, and the machine-checkable no-silent-promotion invariant are clean, well-motivated design points. The conformance evaluation is genuinely falsifiable (path closure, scope disjointness, leakage are measured, not asserted), and the public artifact — schema, loaders, Cypher audit queries Q1–Q7, all six setups, and the v6.0 snapshot with a SHA-256 hash — is exactly the kind of reproducibility this venue should reward. Equally creditable is the epistemic hygiene: the abstract and §7 explicitly disclaim statistical independence and causal family effects, and document-level matching is flagged as an upper bound. The weakness is that the single most quotable number (90.6% precision at unanimity) rests on that coarse matching, and the finer-grained gold needed for a stronger check exists but was not used.

major comments (3)
  1. [§6.1.3, §6.5.2, Table 10, Fig. 6, Abstract] The headline empirical claim — precision rising 25.3%→90.6% as support tightens to unanimity — is computed under document-level matching: an exposed assertion counts as gold-aligned if its technique is annotated anywhere in the same report. With 824 gold instances over 63 annotated documents (~13 gold techniques per document, 663 distinct ⟨d,a⟩ tuples), this criterion is far looser than the claim granularity the framework governs (evidence unit × technique). Unanimity preferentially selects high-frequency, broadly applicable techniques — exactly those most likely to appear somewhere in any document's gold set — so the trajectory mechanically rewards stricter agreement beyond its claim-level correctness. The paper flags this as an upper bound in §6.1.3 and §7.3, which is to its credit, but the abstract and Table 10 carry the unqualified 90.6%, and no finer-grained recomputation is reporte
  2. [§6.1.2 ('Operational policy and analytical agreement views'), §5.4, §6.5.1] The gold operational scope is assigned at document level: a GraphAssertion enters the gold scope when its document-level target matches any trusted annotation of the same document. This is in tension with the framework's own evidence-granularity policy (§5.4: 'the methodology never infers a finer trusted boundary than the source provides') and with the claim that TRACE-CTI preserves native granularity as a core guarantee. Concretely, a sentence-level TRAM annotation for sentence s grounds a gold scope assignment for GraphAssertions attached to *other* evidence units in the same document, so part of the 15,561 gold-backed trusted GraphAssertions (§6.5.1) may rest on evidence the annotator never linked to that technique. Since gold/validated scopes constitute the trusted view — the output downstream users consume — this is load-bearing for RQ3's 'controlled promotion' claim, not merely a m
  3. [§6.4.3, §6.5.2, Fig. 6, Table 10] The two pieces of evidence offered for the informativeness of heterogeneous corroboration are individually sound but jointly weaker than the framing in §6.4.3 ('converging evidence') suggests. The Jaccard comparison is pooled over only 12 same-family vs 48 cross-family stratified comparisons with three generator families, and the cumulative unanimity schedule confounds support threshold k, active-set size, family composition, and ingestion order in a single ladder (v1.0–v6.0); the retriever-axis contrast is negative (−0.020) and receives almost no interpretation. The authors do acknowledge all of this (§6.5.2, §7.1, §7.3) and promise a controlled fixed-k same- vs cross-family comparison as future work. Given that the fixed-k comparison is computable from the already-ingested six-setup snapshot (e.g., compare precision of k=2 support sets that are same-family vs cross-family at v4.0+), I
minor comments (7)
  1. [Abstract] Spacing/typo: 'a controlled 2 x 3 matrix' appears with inconsistent spacing (also 'TRACE- CTI' with a stray space in the abstract). Please normalize.
  2. [§6.1.1 / Table 9] The non-integer mean ATT&CK reach values (e.g., 60.75) are explained as stratum-level means, but the strata are never enumerated; a one-line description of the aggregation strata would help readers reconcile Table 9 with the graph-wide reach of 139 IDs in Table 8.
  3. [§6.2, Table 7] The 101 placeholder AttackTechnique nodes (observed_not_in_current_stix_bundle) are a nice touch, but the split between model-hallucinated IDs, deprecated techniques, and gold annotations from older catalogs is not quantified. Even an approximate breakdown would clarify how much of the 139-ID reach is ontology-mismatch rather than extraction behavior.
  4. [§6.6, Table 11] Q1 and Q7 receive partial marks for the flat baseline; the criteria for partial vs full marks should be stated in one sentence so the comparison does not read as discretionary. Also worth one sentence acknowledging explicitly that the flat baseline is a *minimal* baseline by construction, as §6.6 already implies.
  5. [Fig. 6] The per-corpus thin curves are not labeled with values at each version; adding per-corpus numbers (as in Table 10) or a legend note would make the macro-average trace verifiable from the figure alone.
  6. [§5.1 / Appendix A] The realization of validation events as 'trust metadata and relations' rather than first-class nodes is reasonable, but the audit queries Q3/Q5 depend on it; please confirm (or show in the artifact documentation) that the published Cypher queries operate against the snapshot exactly as shipped, since Dataset/SourceFile/PromptTemplate/EvidenceSpan are also property-realized rather than materialized nodes.
  7. [§6.1.1] The ATT&CK v19.1 bundles are 'retrieved on 22 May 2026' while the upstream retrieval KB and label sets are frozen from the SoK pipeline; a brief note on whether any of the 101 placeholders arise specifically from this version skew (vs. model error) would preempt confusion.

Circularity Check

1 steps flagged

No load-bearing circularity: trusted-view promotion and precision trajectory are evaluated against external gold and explicit multi-setup policy, not by re-labeling predictions as truth.

specific steps
  1. self definitional [§6.5.1 RQ3 operational scopes / gold-scope check]
    "The gold-scope check confirms correct materialization of corpus annotations; its definitional correctness is a conformance result, not an extractor-accuracy claim."

    Gold scope is assigned when a GraphAssertion’s target is backed by a trusted corpus annotation; verifying that gold-backed assertions sit in the gold scope therefore holds by the assignment rule itself. The paper correctly labels this conformance rather than accuracy, so it is not load-bearing for the multi-witness precision trajectory or governance claims—only a minor definitional check.

full rationale

TRACE-CTI is a post-extraction governance systems paper, not a first-principles derivation. Run-level Predictions remain untrusted by default; GraphAssertions enter the trusted view only via recorded gold, analyst, or multi-witness validation under an explicit policy (Sections 4.3, 5.5). Gold-aligned precision/recall of agreement views (25.3%→90.6% precision at k=1→k=6) are computed against external TRAM v2 / AnnoCTR document-level gold tuples, not against the graph’s own trusted view, so the headline trajectory is an external benchmark comparison rather than a fitted input renamed as prediction. ConsensusAssertions are stated not to become trusted by existence. The paper cites Breiman/Dietterich for ensemble motivation and Büchel et al. for the upstream extractor protocol; neither is a same-author uniqueness theorem that forces the result. The sole minor definitional element is RQ3’s gold-scope conformance check, which verifies that GraphAssertions backed by corpus gold are assigned the gold scope—true by the assignment rule and explicitly labeled a conformance result, not extractor accuracy. That does not underwrite the multi-witness precision claim or schema-evolution results. Score 1 reflects that minor definitional conformance only; central empirical and structural claims are independently specified and externally checked.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 3 invented entities

The central governance result rests on standard graph/provenance ideas plus domain choices about what counts as a witness, how gold is matched, and which policy admits trust. Few numeric free parameters drive the headline precision path; the main loads are methodological definitions and evaluation conventions rather than fitted physical constants.

free parameters (3)
  • operational multi-witness threshold k_min=2 = 2 (operational); analytical views use k≥3 and k=6
    Policy choice that admits validated scope when ≥2 distinct parent ExtractionSetups support a target; stricter k and unanimity are analytical views.
  • retrieval depth k_ret and RAG+FSP shot count = k_ret=5; 5 few-shot examples
    Fixed upstream extraction hyperparameters inherited from the SoK pipeline; they shape the Prediction substrate being governed.
  • setup ingestion order S1–S6 = S1…S6 as in Table 6
    Non-randomized cumulative order jointly varies active-set size, family composition, and version; affects the descriptive unanimity trajectory.
axioms (5)
  • domain assumption Extractor outputs are fallible observations and must not equal trusted CTI facts without an explicit validation event.
    Design premise of §1 and §4; motivates separation of Prediction, GraphAssertion, and trusted view.
  • ad hoc to paper Distinct parent ExtractionSetups are distinct witnesses after deduplicating RAG/RAG+FSP and seeds; distinctness is not statistical independence.
    Core multi-witness definition in §4.4; paper repeatedly warns independence is not assumed.
  • domain assumption Native evidence granularity must be preserved: sentence labels are not refined into artificial spans.
    §2.3 and §5.4; affects audit meaning of support.
  • ad hoc to paper Document-level gold tuple matching is an acceptable upper-bound proxy for gold-aligned precision/recall in this evaluation.
    §6.1.3 measurement policy; coarser than sentence/span recovery.
  • standard math Standard knowledge-graph and provenance machinery (entities, relations, versioned active state) can represent CTI claim lifecycle without new formal logic.
    Implements methodology in Neo4j/Cypher; cites Hogan et al. and PROV-O as background.
invented entities (3)
  • GraphAssertion (configuration-level claim g=⟨e,a,c⟩) independent evidence
    purpose: Aggregate run-level Predictions into the unit of operational scope and trusted-view exposure.
    Schema invention central to the lifecycle; engineering construct, not a physical entity.
  • ConsensusAssertion (target-level corroboration summary) independent evidence
    purpose: Materialize setup-deduplicated multi-setup support without auto-promoting trust.
    Key governance object; falsifiable via graph queries and support counts in the released snapshot.
  • Four exclusive operational scopes (gold, validated, prediction-only, deprecated) independent evidence
    purpose: Partition assertions for policy-compliant trusted view and audit.
    Policy typology introduced for TRACE-CTI; checked for disjointness in evaluation.

pith-pipeline@v1.2.0-grok45-kimik3 · 34864 in / 3607 out tokens · 62420 ms · 2026-07-31T11:37:37.159730+00:00 · methodology

0 comments
read the original abstract

Security Operations Centers increasingly rely on automated mapping of Cyber Threat Intelligence reports to MITRE ATT&CK, yet extractor outputs remain fallible and are often stored without the evidence, provenance, and validation history needed to decide whether an individual mapping should be trusted. We present TRACE- CTI, a post-extraction claim-governance framework that preserves run-level Predictions, aggregates them into configuration-level GraphAssertions, materializes setup-deduplicated corroboration as ConsensusAssertions, and exposes only GraphAssertions backed by policy-compliant validation grounds. The framework retains native evidence granularity, complete extraction provenance, versioned trust decisions, and non-destructive revocation history. We evaluate TRACE-CTI on two public CTI corpora comprising 65 reports and 5,303 sentences, using a controlled 2 x 3 matrix of retrievers and generator families, incrementally ingested across six GraphVersions. All setups are incorporated without schema modification; provenance paths remain complete, operational scopes remain disjoint, and every trusted GraphAssertion has an active qualifying validation ground. Cross-generator-family setup pairs exhibit greater output diversity than same-family pairs. At the final graph state, increasing setup support from k >= 1 to six-setup unanimity raises gold-aligned precision from 25.3% to 90.6%, while recall decreases from 88.2% to 16.3%. The graph also directly answers seven questions about provenance, trust, versioning, dependency, disagreement, and review-queue that the evaluated minimal flat output cannot fully answer without enrichment or reprocessing. These results support explicit, auditable governance of extracted TTP claims; the observed corroboration trajectory is descriptive and does not establish statistical independence or a causal model-family effect.

Figures

Figures reproduced from arXiv: 2607.24563 by Alessio Merlo, Enrico Russo, Federico Valletta, Giacomo Longo.

Figure 1
Figure 1. Figure 1: Claim-governance lifecycle. The audit history is append-only, whereas the active trusted view is derived [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Process view of TRACE-CTI. Grounding precedes cross-setup comparison; validation records determine [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Provenance and governance paths from run-level Predictions to configuration-level GraphAssertions and [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Evolution across v1.0–v6.0 of assertions, ATT&CK reach, corroborated targets, and strict unanimity. [PITH_FULL_IMAGE:figures/full_fig_p017_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Setup-pair output diversity by configuration [PITH_FULL_IMAGE:figures/full_fig_p018_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Document-level gold-aligned precision and recall of the cumulative unanimity exposure view, v1.0–v6.0. [PITH_FULL_IMAGE:figures/full_fig_p020_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

17 extracted references · 1 canonical work pages

  1. [6]

    An- noCTR: A dataset for detecting and linking entities, tactics, andtechniquesincyberthreatreports

    Lukas Lange, Marc Reiter, and Jannik Strötgen. An- noCTR: A dataset for detecting and linking entities, tactics, andtechniquesincyberthreatreports. InPro- ceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING), pages 1052–1065,

    2024

  2. [9]

    Xiaojing Liao, Kan Yuan, XiaoFeng Wang, Zhou Li, Luyi Xing, and Raheem Beyah

    doi: 10.1007/978-3-031-17140-6_29. Xiaojing Liao, Kan Yuan, XiaoFeng Wang, Zhou Li, Luyi Xing, and Raheem Beyah. Acing the IOC game: Toward automatic discovery and analysis of open- source cyber threat intelligence. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 755–766. ACM,

    doi:10.1007/978-3-031-17140-6_29 2016

  3. [11]

    Milajerdi, Birhanu Eshete, Rigel Gjomemo, and V

    Sadegh M. Milajerdi, Birhanu Eshete, Rigel Gjomemo, and V. N. Venkatakrishnan. POIROT: Aligning at- tack behavior with kernel audit records for cyber threat hunting. InProceedings of the 2019 ACM SIGSAC Conference on Computer and Communica- tions Security (CCS), pages 1795–1812. ACM,

    2019

  4. [13]

    doi: 10.1109/ISSRE55969.2022. 00031. Aritran Piplai, Sudip Mittal, Anupam Joshi, Tim Finin, James Holt, and Richard Zak. Creating cybersecurity knowledge graphs from malware after action reports. IEEE Access, 8:211691–211703,

    arXiv 2022

  5. [17]

    Text embeddings by weakly- supervised contrastive pre-training

    Liang Wang, Nan Yang, Xiaolong Huang, Binx- ing Jiao, Linjun Yang, Daxin Jiang, Rangan Ma- jumder, and Furu Wei. Text embeddings by weakly- supervised contrastive pre-training. arXiv preprint arXiv:2212.03533,

    Pith/arXiv arXiv

  6. [2000]

    Linking threat tactics, techniques, and patterns with defensive weaknesses, vulnerabilities and affected platform configurations for cyber hunting

    Erik Hemberg, Jonathan Kelly, Michal Shlapentokh- Rothman, Bryn Reinstadler, Katherine Xu, Nick Ru- tar, and Una-May O’Reilly. Linking threat tactics, techniques, and patterns with defensive weaknesses, vulnerabilities and affected platform configurations for cyber hunting. arXiv preprint arXiv:2010.00533,

    Pith/arXiv arXiv 2010

  7. [2001]

    doi: 10.1023/A:1010933404324. Marvin Büchel, Tommaso Paladini, Stefano Lon- gari, Michele Carminati, Stefano Zanero, Ho- daya Binyamini, Gal Engelberg, Dan Klein, Gian- carlo Guizzardi, Marco Caselli, Andrea Continella, Maarten van Steen, Andreas Peter, and Thijs van Ede. SoK: Automated TTP extraction from CTI reports – are we there yet? InProceedings of ...

    doi:10.1023/a:1010933404324

  8. [2013]

    Valentine Legoy, Marco Caselli, Christian Seifert, and Andreas Peter

    URL https://www.w3.org/TR/prov-o/. Valentine Legoy, Marco Caselli, Christian Seifert, and Andreas Peter. rcATT: A tool for automatic classifica- tion of threat reports with MITRE ATT&CK tactics 24 and techniques. arXiv preprint arXiv:2004.14322,

    Pith/arXiv arXiv 2004

  9. [2015]

    MISP: The design and implemen- tation of a collaborative threat intelligence sharing platform

    Cynthia Wagner, Alexandre Dulaunoy, Gérard Wagener, and Andras Iklody. MISP: The design and implemen- tation of a collaborative threat intelligence sharing platform. InProceedings of the 2016 ACM Workshop on Information Sharing and Collaborative Security (WISCS), pages 49–56. ACM,

    2016

  10. [2016]

    doi: 10.1145/2976749.2978315. Meta AI. The Llama 3 herd of models. arXiv preprint arXiv:2407.21783,

    arXiv

  11. [2017]

    doi: 10.1145/3134600. 3134646. ZiweiJi, NayeonLee, RitaFrieske, TiezhengYu, DanSu, Yan Xu, Etsuko Ishii, Yejin Bang, Andrea Madotto, and Pascale Fung. Survey of hallucination in natural language generation.ACM Computing Surveys, 55 (12):1–38,

    work page doi:10.1145/3134600

  12. [2019]

    Neo4j, Inc

    doi: 10.1145/3319535.3363217. Neo4j, Inc. Neo4j graph database.https://neo4j.com,

    arXiv

  13. [2020]

    Nidhi Rastogi, Sharmishtha Dutta, Mohammed J

    doi: 10.1109/ ACCESS.2020.3039234. Nidhi Rastogi, Sharmishtha Dutta, Mohammed J. Zaki, Alex Gittens, and Charu Aggarwal. MALOnt: An ontology for malware threat intelligence. InInter- national Workshop on Deployable Machine Learning for Security Defense (MLHat), pages 28–44. Springer,

    arXiv 2020

  14. [2021]

    doi: 10.1109/EuroSP51992.2021.00046. Blake E. Strom, Andy Applebaum, Doug P. Miller, Kathryn C. Nickels, Adam G. Pennington, and Cody B. Thomas. MITRE ATT&CK: Design and phi- losophy. Technical report, The MITRE Corporation,

    arXiv 2021

  15. [2022]

    Looking beyond IoCs: Automati- cally extracting attack patterns from external CTI

    Md Tanvirul Alam, Dipkamal Bhusal, Youngja Park, and Nidhi Rastogi. Looking beyond IoCs: Automati- cally extracting attack patterns from external CTI. arXiv preprint arXiv:2211.01753,

    Pith/arXiv arXiv

  16. [2023]

    Albert Q

    doi: 10.1145/3571730. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Men- sch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guil- laume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral ...

    Pith/arXiv arXiv

  17. [2024]

    Zhenyuan Li, Jun Zeng, Yan Chen, and Zhenkai Liang

    doi: 10.1016/j.cose.2024.103815. Zhenyuan Li, Jun Zeng, Yan Chen, and Zhenkai Liang. AttacKG: Constructing technique knowledge graph from cyber threat intelligence reports. InProceed- ings of the 27th European Symposium on Research in Computer Security (ESORICS), pages 589–609. Springer,

    arXiv 2024