Large-scale LLM analysis of 16k CTI reports over 20 years shows a fragmented vendor ecosystem with low overlap and reporting biases.
Sok: automated ttp extraction from cti reports - are we there yet? InProceedings of the 34th USENIX Conference on Security Symposium, SEC ’25, USA
1 Pith paper cite this work. Polarity classification is still indexing.
1
Pith paper citing it
fields
cs.CR 1years
2026 1verdicts
UNVERDICTED 1representative citing papers
citing papers explorer
-
The CTI Echo Chamber: Fragmentation, Overlap, and Vendor Specificity in Twenty Years of Cyber Threat Reporting
Large-scale LLM analysis of 16k CTI reports over 20 years shows a fragmented vendor ecosystem with low overlap and reporting biases.