Abstract:Cyber Threat Intelligence (CTI) reporting is pivotal in contemporary risk management strategies. As the volume of CTI reports continues to surge, the demand for automated tools to streamline report generation becomes increasingly apparent. While Natural Language Processing techniques have shown potential in handling text data, they often struggle to address the complexity of diverse data sources and their intricate interrelationships. Moreover, established paradigms like STIX have emerged as de facto standards within the CTI community, emphasizing the formal categorization of entities and relations to facilitate consistent data sharing. In this paper, we introduce AGIR (Automatic Generation of Intelligence Reports), a transformative Natural Language Generation tool specifically designed to address the pressing challenges in the realm of CTI reporting. AGIR's primary objective is to empower security analysts by automating the labor-intensive task of generating comprehensive intelligence reports from formal representations of entity graphs. AGIR utilizes a two-stage pipeline by combining the advantages of template-based approaches and the capabilities of Large Language Models such as ChatGPT. We evaluate AGIR's report generation capabilities both quantitatively and qualitatively. The generated reports accurately convey information expressed through formal language, achieving a high recall value (0.99) without introducing hallucination. Furthermore, we compare the fluency and utility of the reports with state-of-the-art approaches, showing how AGIR achieves higher scores in terms of Syntactic Log-Odds Ratio (SLOR) and through questionnaires. By using our tool, we estimate that the report writing time is reduced by more than 40%, therefore streamlining the CTI production of any organization and contributing to the automation of several CTI tasks.

AGIR: Automating Cyber Threat Intelligence Reporting with Natural Language Generation

CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports

Automating Government Report Generation: A Generative AI Approach for Efficient Data Extraction, Analysis, and Visualization

Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild

Satyrn: A Platform for Analytics Augmented Generation

AI-Driven Cyber Threat Intelligence Automation

Automatic Generation of Malware Threat Intelligence from Unstructured Malware Traces

AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports

Towards an AI-Enhanced Cyber Threat Intelligence Processing Pipeline

NLP-Based Techniques for Cyber Threat Intelligence

Enhancing Cybersecurity With Artificial Immune Systems and General Intelligence: A New Frontier in Threat Detection and Response

STIXnet: A Novel and Modular Solution for Extracting All STIX Objects in CTI Reports

ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management

The Potential of Using Generative AI/NLP to Identify and Analyse Critical Incidents in a Critical Incident Reporting System (CIRS): A Feasibility Case–Control Study

Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports

Using Generative AI Models to Support Cybersecurity Analysts

Actionable Cyber Threat Intelligence using Knowledge Graphs and Large Language Models

FABULA: Intelligence Report Generation Using Retrieval-Augmented Narrative Construction

SmartBook: AI-Assisted Situation Report Generation for Intelligence Analysts

Automating IETF Insights generation with AI