REVIEW 4 major objections 5 minor 28 references
Towards a scalable AI-driven framework for data-independent Cyber Threat Intelligence Information Extraction
T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash
Pith's one-line read The paper claims that 0-CTI, a modular transformer-based pipeline, extracts STIX-compliant cyber threat entities and relations from unstructured reports in both supervised and fully zero-shot modes, with the supervised entity extractor…
desk verdict The 0-CTI pipeline is a sensible, practically useful integration of existing components, but the paper's headline claim of surpassing state-of-the-art supervised entity extraction rests on a comparison that likely leaks training data and needs to be redone before it is credible. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the cross-encoder entailment scorer for zero-shot relation extraction. A cross-encoder processes two sequences together and returns a score for whether the second is entailed by the first; here it decides whether a candidate '<entity1> <relation> <entity2>' sentence is supported by the original report, and thresholding plus directional disambiguation convert those scores into accepted STIX relationship objects. For entities, the zero-shot path uses a generalist NER model that frames extraction as natural-language inference and is steered by a hand-built flat taxonomy mapping child labels to STIX parent classes, while the supervised path fine-tunes a transformer on annotated entities. The pipeline's modularity lets the regex-based IOC finder, the supervised NER core, and the zero-shot NER core be combined or swapped, with entity outputs feeding the relation module.
What would settle it
Annotate all STIX relationships in the 120 CTI reports used in the LLM-as-a-Judge evaluation with two independent human analysts, then compute precision, recall, and F1 for the zero-shot relation extractor at the paper's reported threshold and across a sweep of thresholds. If no threshold separates true from spurious candidate relations, or if the LLM judge's scores do not track the human annotations, the central dataless relation-extraction claim is falsified.
Extended reading notes
Core claim
On its own terms, 0-CTI's discovery is that relation extraction can be made fully dataless by recasting it as textual entailment. After entities are extracted, the system looks up which STIX relationship objects are permitted between the two entity types and generates candidate sentences of the form '<entity1> <relation> <entity2>'; a cross-encoder scores whether the original report text entails each candidate, and a threshold plus a directional tie-break keep only the most plausible relations. The same zero-shot principle is applied to entities by combining a generalist NER model with a flat taxonomy whose fine-grained child labels roll up into STIX domain objects. In the supervised branch, a cybersecurity-domain BERT model fine-tuned for token classification is reported to reach F1 of 0.98 on the STIXnet dataset against STIXnet's 0.77. The paper states that the zero-shot components were evaluated qualitatively with an LLM-as-a-Judge method, yielding average scores of 0.91 for entities and 0.83 for relations, while a gold-annotated relation benchmark is listed as ongoing future work.
Load-bearing premise
The load-bearing premise is that a general-purpose cross-encoder trained on natural-language inference data can correctly judge whether a generated sentence like 'APT1 targets Microsoft' is entailed by a threat report, and that this entailment score reliably separates true relations from spurious ones; the paper tests this only with an LLM-as-a-Judge evaluation, not against gold relation annotations.
Editorial extensions
If this is right
- A team with no annotated corpus can run the full entity-plus-relation extraction pipeline in zero-shot mode and receive STIX-formatted knowledge graph output.
- The supervised NER core is claimed to beat the prior STIXnet system, reaching F1 0.98 versus 0.77 on the STIXnet dataset.
- Because the output uses STIX relationship objects, extracted intelligence can be shared across organizations and integrated into existing CTI tooling without reformatting.
- The modular design allows the regex-based IOC finder, the supervised NER core, and the zero-shot NER core to be combined or swapped independently, so upgrades can target one submodule at a time.
- Errors in entity extraction propagate into relation scoring, so any improvement in NER, supervised or zero-shot, directly improves relation extraction quality.
Reading between the lines
- The generate-and-score entailment recipe is domain-agnostic: any field with a closed relation vocabulary and typed entity pairs could reuse it, provided the cross-encoder's language coverage fits the domain.
- The LLM-as-a-Judge scores are a provisional substitute for gold labels; the reported 0.83 for relations could shift materially once human-annotated relation benchmarks are used, so the zero-shot relation extraction claim should be read as promising rather than settled.
- The 'data-independent' label is best understood as annotation-free rather than tuning-free: the flat taxonomy, the relation candidate list, and the thresholds are hand-designed components that carry real engineering weight.
- A natural extension is active learning, where the cross-encoder's confidence scores flag uncertain relations for analyst review, blending zero-shot coverage with minimal human labeling effort.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces 0-CTI, a modular framework for Cyber Threat Intelligence Information Extraction that combines text preprocessing, an IOC-finder, supervised or zero-shot named entity recognition, and a cross-encoder-based relation extraction module, with outputs aligned to the STIX format. The system supports a fully zero-shot pipeline using GLiNER for entities and a cross-encoder NLI-style scorer for relations, and a supervised pipeline fine-tuned on the authors' annotated OpenCTI-derived dataset or on the STIXnet dataset. The paper claims that 0-CTI is the first modular CTI-IE framework supporting both supervised and zero-shot learning, that its supervised entity extractor surpasses state-of-the-art performance (0.98 F1 vs. STIXnet's 0.77 on the STIXnet dataset), and that zero-shot entity and relation extraction obtain LLM-as-a-judge scores of 0.91 and 0.83 on 120 CTI reports.
Significance. If the empirical claims were validated, 0-CTI would be a practically useful contribution: it combines existing transformer components into a single STIX-compliant pipeline, offers a dataless mode for relation extraction, and reports detailed entity distributions that could help future benchmark design. The architectural modularity and the use of a fixed STIX relation table are sensible design choices, and the paper gives a reasonably complete description of the pipeline. However, the central quantitative claims are not currently established: the supervised state-of-the-art comparison in Table IV is compromised by the lack of a documented held-out split, and the zero-shot evaluation in Section V-B relies on an unvalidated LLM judge instead of ground truth. The paper contains no machine-checked proofs, no released code, and no parameter-free derivations; its contribution is purely empirical and therefore depends directly on the soundness of the evaluation protocol.
major comments (4)
- [§V-A-2, Table IV] The abstract's claim that the supervised Entity Extractor 'surpasses current state-of-the-art performance' rests on Table IV, but this comparison is not valid as reported. The authors state that they fine-tuned 0-CTI CyBERT on the STIXnet dataset, and the table then reports 0.98 overall F1 versus STIXnet's 0.77 on that dataset. No held-out split, cross-validation, or multiple-seed variance is documented. Because STIXnet is rule-based and does not train on the reports, while 0-CTI's fine-tuned model does, the reported gap may be fully explained by information leakage from training on the evaluation instances. A valid comparison requires a held-out test set or k-fold evaluation, with STIXnet scored on the same held-out instances and with repeated training runs to estimate variance.
- [§V-B] The zero-shot evaluation uses ChatGPT-4 as an LLM judge rather than gold annotations, and no evidence is provided that the judge's scores correlate with human judgments or with downstream task performance. The reported average scores of 0.91 for zero-shot NER and 0.83 for zero-shot relation extraction are therefore not established as measures of extraction quality. The paper itself acknowledges in §V that no relation-annotated dataset is available and in §VI that acquiring annotated data is future work; at least a subset of the 120 reports should be scored against human annotations before the zero-shot claims are made.
- [§V-A-1, Table III] The supervised NER comparison reports single point estimates from one 3500/880 train/test split, with no standard deviations, confidence intervals, or significance tests. Given the large class-level F1 differences (for example, 0.61 versus 0.27 for IDENTITY ORGANIZATION), these differences may be within noise. The claim that the transformer cores outperform the LSTM baseline requires multiple seeds and, ideally, a statistical test over repeated runs, or at least error bars.
- [§V-A and Abstract] The 'state-of-the-art' claim is under-supported even if the split issue is set aside: the only quantitative baseline in Table IV is STIXnet, while several other cyber-NER systems discussed in §III (CyNER, Li et al., Wang et al., Zhou et al.) are not evaluated under the same protocol. At minimum, the claim should be narrowed to 'outperforms STIXnet on this dataset,' or additional baselines should be included under identical training and evaluation conditions.
minor comments (5)
- [§II] The text says STIX comprises 'six distinct classes,' but the footnote and the rest of the paper refer to 18 SDOs; this inconsistency should be reconciled.
- [§IV-A] The word 'sanification' should be 'sanitization,' and the term 'chunkizer' is used informally; please define it or use standard terminology.
- [§IV-C-2] The relation extraction algorithm relies on a 'predefined threshold' for accepting relations, but no threshold value, tuning procedure, or sensitivity analysis is reported, which hinders reproducibility.
- [§IV-B] The claim that the IOC-finder's accuracy is 'approaching 100%' is not supported by any reported evaluation; if its results are excluded from all metrics, that assumption should be stated explicitly.
- [§IV-C-1] The description of GLiNER as interpreting NER as a natural language inference problem is imprecise; GLiNER is a bidirectional transformer trained for span matching, so the mechanism should be described accurately.
Circularity Check
The SOTA claim in the abstract reduces to a training-set F1: 0-CTI CyBERT is fine-tuned on the STIXnet dataset and then evaluated on the same dataset with no documented held-out split.
-
fitted input called prediction
[Abstract and Section V-A-2, Table IV.]
"Additionally, our supervised Entity Extractor surpasses current state-of-the-art performance in cyber Entity Extraction. ... Our approach involved fine-tuning the 0-CTI CyBERT model on the new dataset. The preprocessing steps and training configurations mirrored those of the first experiment."
The reported 0.98 overall F1 in Table IV is the evidence for the abstract claim that the supervised Entity Extractor 'surpasses current state-of-the-art performance.' However, the model was fine-tuned on the STIXnet dataset and then scored on 'the dataset used in [17]' with no held-out split described. The entity labels being predicted on evaluation are the same labels used as training targets, so the F1 is a training-fit score, not an independent prediction. The comparison with STIXnet therefore reduces by construction to how well the model memorized its input; a held-out or k-fold evaluation would be required for the SOTA claim.
full rationale
The zero-shot Entity and Relation Extraction modules are pipelines over external pretrained models (GLiNER and an NLI cross-encoder) and the fixed STIX SRO table; they involve no fitted parameter that is renamed as a prediction. The LLM-as-a-Judge evaluation is also external rather than self-referential. The only load-bearing circular step is the supervised NER comparison in Section V-A-2: the model is fine-tuned on the STIXnet dataset and then the 'Evaluation F1-score' in Table IV is computed, with no train/test split documented, so the reported advantage over the rule-based STIXnet is a training-fit value rather than a held-out prediction. The paper itself states that relation-extraction evaluation is still ongoing and lacks gold annotations, but this is a missing-validation limitation, not circularity. The score reflects the central abstract claim being tied to the training-set result.
Assumptions & free parameters
free parameters (3)
- NER confidence merging threshold =
not reported
- Relation extraction acceptance threshold =
not reported
- Recursive chunkizer parameters =
not reported
assumptions (5)
- domain assumption The selected STIX SDO, SCO, and SRO classes form a valid and sufficient ontology for CTI information extraction.
- domain assumption A cross-encoder trained on NLI data can determine whether a generated candidate relation sentence is entailed by the original CTI text.
- ad hoc to paper ChatGPT-4 as a judge produces trustworthy quality scores for zero-shot entity and relation extraction.
- domain assumption GLiNER generalizes to STIX entity classes in zero-shot mode without CTI-specific fine-tuning.
- domain assumption The OpenCTI-sourced dataset is representative and its entity annotations are correct.
Cite this review
Pith. "Pith review of Towards a scalable AI-driven framework for data-independent Cyber Threat Intelligence Information Extraction." pith.science (2026). https://pith.science/paper/MQHITOO3
@misc{pith2026250106239,
author = {Pith},
title = {Pith review of: Towards a scalable AI-driven framework for data-independent Cyber Threat Intelligence Information Extraction},
year = {2026},
howpublished = {\url{https://pith.science/paper/MQHITOO3}},
note = {Machine review of arXiv:2501.06239}
}
read the original abstract
Cyber Threat Intelligence (CTI) is critical for mitigating threats to organizations, governments, and institutions, yet the necessary data are often dispersed across diverse formats. AI-driven solutions for CTI Information Extraction (IE) typically depend on high-quality, annotated data, which are not always available. This paper introduces 0-CTI, a scalable AI-based framework designed for efficient CTI Information Extraction. Leveraging advanced Natural Language Processing (NLP) techniques, particularly Transformer-based architectures, the proposed system processes complete text sequences of CTI reports to extract a cyber ontology of named entities and their relationships. Our contribution is the development of 0-CTI, the first modular framework for CTI Information Extraction that supports both supervised and zero-shot learning. Unlike existing state-of-the-art models that rely heavily on annotated datasets, our system enables fully dataless operation through zero-shot methods for both Entity and Relation Extraction, making it adaptable to various data availability scenarios. Additionally, our supervised Entity Extractor surpasses current state-of-the-art performance in cyber Entity Extraction, highlighting the dual strength of the framework in both low-resource and data-rich environments. By aligning the system's outputs with the Structured Threat Information Expression (STIX) format, a standard for information exchange in the cybersecurity domain, 0-CTI standardizes extracted knowledge, enhancing communication and collaboration in cybersecurity operations.
Figures
Reference graph
Works this paper leans on
-
[1]
A systematic literature review on cyber threat intelligence sharing,
Y . Zhang, Y . Wu, X. Li, and G. Zhao, “A systematic literature review on cyber threat intelligence sharing,”Information Systems Frontiers, vol. 10, no. 2, pp. 45–64, 2022
work page 2022
-
[2]
Ar- tificial intelligence methods for cyber threats intelligence,
R. Trifonov, S. Manolov, R. Yoshinov, G. Tsochev, and G. Pavlova, “Ar- tificial intelligence methods for cyber threats intelligence,” International Journal of Computers , vol. 2, 2017
work page 2017
-
[3]
Artificial intelligence, cyber-threats and industry 4.0: Challenges and opportunities,
A. B ´ecue, I. Prac ¸a, and J. Gama, “Artificial intelligence, cyber-threats and industry 4.0: Challenges and opportunities,” Artificial Intelligence Review, vol. 54, no. 5, pp. 3849–3886, 2021
work page 2021
-
[4]
GLiNER: Generalist Model for Named Entity Recognition using Bidirectional Transformer,
U. Zaratiana, N. Tomeh, P. Holat, and T. Charnois, “GLiNER: Generalist Model for Named Entity Recognition using Bidirectional Transformer,” arXiv preprint arXiv:2311.08526 , 2023
arXiv 2023
-
[5]
S. Barnum, “Standardizing Cyber Threat Intelligence Information with the Structured Threat Information eXpression (STIX),” Mitre Corpora- tion, pp. 1–22, 2012
work page 2012
-
[6]
Information extraction: Past, present and future,
J. Piskorski and R. Yangarber, “Information extraction: Past, present and future,” ACM Computing Surveys , no. 3, pp. 213–239, 2013
work page 2013
-
[7]
Information Extraction of Cybersecurity Concepts: An LSTM Approach,
H. Gasmi, J. Laval, and A. Bouras, “Information Extraction of Cybersecurity Concepts: An LSTM Approach,” Applied Sciences , vol. 9, no. 19, p. 4137, 2019. [Online]. Available: https://www.mdpi. com/2076-3417/9/19/4137
work page 2019
-
[8]
Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports,
V . Legoy, M. Caselli, C. Seifert, and A. Peter, “Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports,” arXiv preprint arXiv:2004.14322 , 2020. [Online]. Available: https://arxiv.org/abs/2004.14322
arXiv 2004
Show all 28 references
-
[9]
Automated Extraction of Vulnerability Information for Home Computer Security,
S. Weerawardhana, S. Mukherjee, I. Ray, and A. Howe, “Automated Extraction of Vulnerability Information for Home Computer Security,” in Foundations and Practice of Security , F. Cuppens, J. Garcia-Alfaro, N. Zincir Heywood, and P. W. L. Fong, Eds. Springer International Publis...
2015
-
[10]
A Self-Attention-Based Approach for Named Entity Recognition in Cybersecurity,
T. Li, Y . Guo, and A. Ju, “A Self-Attention-Based Approach for Named Entity Recognition in Cybersecurity,” in 2019 15th International Conference on Computational Intelligence and Security (CIS) . IEEE, 2019, pp. 1–6. [Online]. Available: https://ieeexplore.ieee.org/document/ 9023758
2019
-
[11]
CyBERT: Contextualized Embeddings for the Cybersecurity Domain,
P. Ranade, A. Piplai, A. Joshi, and T. Finin, “CyBERT: Contextualized Embeddings for the Cybersecurity Domain,” arXiv preprint arXiv:2108.00382 , 2021. [Online]. Available: https://arxiv.org/pdf/2108.00382.pdf
2021 arXiv
-
[12]
MTEB: Massive Text Embedding Benchmark,
N. Muennighoff, N. Tazi, L. Magne, and N. Reimers, “MTEB: Massive Text Embedding Benchmark,” arXiv preprint arXiv:2210.07316 , 2022. [Online]. Available: https://arxiv.org/abs/2210.07316
2022 arXiv
-
[13]
Cy- ber Threat Intelligence Entity Extraction Based on Deep Learning and Field Knowledge Engineering,
X. Wang, R. Liu, J. Yang, R. Chen, Z. Ling, P. Yang, and K. Zhang, “Cy- ber Threat Intelligence Entity Extraction Based on Deep Learning and Field Knowledge Engineering,” Security & Communication Networks , pp. 1–14, 2023
2023
-
[14]
CyNER: A Python Library for Cybersecurity Named Entity Recognition,
M. T. Alam, D. Bhusal, Y . Park, and N. Rastogi, “CyNER: A Python Library for Cybersecurity Named Entity Recognition,” arXiv preprint arXiv:2204.05754, 2022
2022 arXiv
-
[15]
CTI View: APT Threat Intelligence Analysis System,
Y . Zhou, Y . Tang, M. Yi, C. Xi, and H. Lu, “CTI View: APT Threat Intelligence Analysis System,” Security & Communication Networks , 2022
2022
-
[16]
CDTier: A Chinese Dataset of Threat Intelligence Entity Relation- ships,
Y . Zhou, Y . Ren, M. Yi, Y . Xiao, Z. Tan, N. Moustafa, and Z. Tian, “CDTier: A Chinese Dataset of Threat Intelligence Entity Relation- ships,” IEEE Transactions on Sustainable Computing , pp. 1–13, 2023
2023
-
[17]
STIXnet: A Novel and Modular Solution for Extracting All STIX Objects in CTI Reports,
F. Marchiori and M. Conti, “STIXnet: A Novel and Modular Solution for Extracting All STIX Objects in CTI Reports,” in Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES 2023) . Springer, 2023. [Online]. Available: https://arxiv.org...
2023 arXiv
-
[18]
LLaMa: Open and Efficient Foundation Language Models,
H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, N. Ballas, T. Lacroix, G. Synnaeve, J. Uszkoreit, J. Ponce, M. Douze, and H. J´egou, “LLaMa: Open and Efficient Foundation Language Models,” arXiv preprint arXiv:2302.13971, 2023
2023 arXiv
-
[19]
InstructUIE: An Instruction-tuned Universal Information Extraction Model,
X. Wang, J. Du, T. Liao, S. Li, X. Yin, X. Ding, and T. Liu, “InstructUIE: An Instruction-tuned Universal Information Extraction Model,” arXiv preprint arXiv:2301.13628, 2023
2023 arXiv
-
[20]
Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer,
C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y . Zhou, W. Li, and P. J. Liu, “Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer,” arXiv preprint arXiv:1910.10683, 2019
1910 arXiv
-
[21]
Scaling Instruction-Finetuned Language Models,
H. W. Chung, L. Hou, S. Longpre, B. Zoph, Y . Tay, W. Fedus, J. Dean, Y . Yang, N. Du, and W. Li, “Scaling Instruction-Finetuned Language Models,” arXiv preprint arXiv:2210.11416 , 2022
2022 arXiv
-
[22]
GoLLIE: Generalized Open-Domain Information Extraction,
O. Sainz, O. L. de Lacalle, A. Soroa, and E. Agirre, “GoLLIE: Generalized Open-Domain Information Extraction,” arXiv preprint arXiv:2304.08427, 2023
2023 arXiv
-
[23]
CodeLLaMa: Open and Efficient Foundation Language Models for Code,
B. Rozi `ere, A. Almahairi, R. Rinott, H. Touvron, V . Nakano, S. Diao, A. Gu, and G. Lample, “CodeLLaMa: Open and Efficient Foundation Language Models for Code,” arXiv preprint arXiv:2308.12950 , 2023
2023 arXiv
-
[24]
UniversalNER: Targeted Distillation from Large Language Models for Open Named Entity Recognition,
B. Zhou, J. Fan, L. Shou, M. Gong, J. Pei, and D. Jiang, “UniversalNER: Targeted Distillation from Large Language Models for Open Named Entity Recognition,” arXiv preprint arXiv:2303.08391 , 2023
2023 arXiv
-
[25]
C-Pack: Packaged Resources To Advance General Chinese Embedding,
S. Xiao, Z. Liu, P. Zhang, and N. Muennighoff, “C-Pack: Packaged Resources To Advance General Chinese Embedding,” 2023
2023
-
[26]
In defense of cross-encoders for zero-shot retrieval,
G. Rosa, L. Bonifacio, V . Jeronymo, H. Abonizio, M. Fadaee, R. Lotufo, and R. Nogueira, “In defense of cross-encoders for zero-shot retrieval,” arXiv preprint arXiv:2212.06121 , 2022
2022 arXiv
-
[27]
Natural language processing in the era of large language models,
A. Zubiaga, “Natural language processing in the era of large language models,” p. 1350306, 2024
2024
-
[28]
An empirical study of llm-as-a-judge for llm evaluation: Fine-tuned judge models are task- specific classifiers,
H. Huang, Y . Qu, J. Liu, M. Yang, and T. Zhao, “An empirical study of llm-as-a-judge for llm evaluation: Fine-tuned judge models are task- specific classifiers,” arXiv preprint arXiv:2403.02839 , 2024
2024 arXiv
Reviewed August 10, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.