Automated STIX Report Generation from Threat Intelligence Text
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in automatically extracting and transforming cyber threat intelligence (CTI) data from unstructured and semi-structured text into machine-readable, standardized STIX formats, due to the complexity of cybersecurity text and the inability of NLP pipelines to understand context and relationships.
Innovation Solution
An automated tool is developed to generate STIX reports from threat intelligence text, utilizing a combination of regular expressions, large language models (LLMs), and custom prompts to identify entities, determine entity types, and extract relationships, ensuring compatibility with the STIX standard.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual methods are used to extract and transform CTI data into STIX formats, then accuracy can be maintained through expert analysis, but the process becomes extremely time-consuming and labor-intensive
Solution Approach 1:
The patent introduces an automated NLP pipeline as an intermediary system between unstructured threat intelligence text and STIX format output. This pipeline includes multiple processing stages (entity detection, relation extraction, STIX generation) that automatically transform text while maintaining quality through structured processing, eliminating the need for manual expert analysis for every report.
Solution Approach 2:
The extraction process is divided into distinct modular stages: entity detection, entity type classification, relation extraction, and STIX report generation. Each stage handles specific tasks independently, allowing for optimized processing at each step and enabling parallel processing where applicable, thus reducing overall processing time while maintaining accuracy.
2Productivity
If automated NLP pipelines are used to extract entities and relationships, then processing speed increases, but the system fails to understand cybersecurity text context and relationships
Solution Approach 1:
The system performs preliminary actions by pre-processing the threat intelligence text to identify and extract potential entities before relation extraction. Entity detection and type classification are completed first, creating a structured foundation that enables more accurate relation extraction in subsequent steps, improving both speed and context understanding.
Solution Approach 2:
The patent implements feedback mechanisms where the system continuously refines its entity detection and relation extraction based on identified patterns and contexts. The multi-stage pipeline allows results from earlier stages to inform and improve subsequent stages, with the ability to adjust and optimize based on the specific characteristics of cybersecurity text being processed.
3Speed
If Regular Expressions are used to detect cybersecurity entities, then simple patterns can be identified quickly, but critical entities like registry keys and contextual relationships are missed
Solution Approach 1:
The patent merges multiple detection approaches: Regular Expressions are used for quick pattern matching of known formats (IP addresses, domains), while NLP-based entity detection handles more complex entities like registry keys and contextual relationships. This combination leverages the speed of RegEx for simple cases and the accuracy of NLP for complex cases, achieving both speed and precision.
4Ease of manufacture
If a closed list of keywords is compiled to detect cybersecurity entities, then detection can be simplified, but the system cannot generalize to new entities and proper nouns vary from report to report
Solution Approach 1:
The system transitions from static keyword matching to dynamic entity detection. Instead of relying on a fixed closed list of keywords, the NLP-based entity detection adapts to identify entities based on their contextual characteristics and patterns in the text. This allows the system to generalize to new entities, malware names, attack tool names, and identities that vary from report to report while maintaining systematic processing.
Data Source
AI summary
The present disclosure relates to an automated tool for STIX report generation from threat intelligence text. In a second aspect of the present disclosure, a method of using an automated tool for STIX report generation from threat intelligence text.