DECEPT-CTI: A Framework for Enhancing Cyber Deception Strategies through NLP-based Extraction of CTI from Unstructured Reports

In today’s dynamic threat landscape, organizations encounter significant challenges when dealing with the vast, evolving, unregulated landscape of cyber threat intelligence (CTI). Firstly, the verbosity of CTI resources infused with a significant amount of irrelevant and unstructured text. Secondly, there is a need for automated systems capable of synthesizing information about threat entities, attack semantics, and malicious actions, which can help rapidly identify and understand emerging threats. Thirdly, organizations face the challenge of injected poisoned or noisy data by threat actors, which can affect not only the quality of CTI but also the efficacy of threat mitigation strategies. Finally, they must harmonize CTI data from various resources and understand the interactions between different threat elements, to understand their threat profiles better, determine the presence of attack vectors related to existing and emerging cyber-attacks, and mount effective cyber defense strategies. To address these challenges, we introduce DECEPTCTI, a framework that recommends the appropriate cyber deception strategies based on the provided CTI knowledge. First we automatically extract relevant CTI sentences and identify low-level and high-level IoCs from unstructured CTI reports. Then, we propose a multi-label classification-based model for automated mapping of extracted CTI data to MITRE ATT&CK tactics and techniques. Subsequently, we apply an analytical scheme based on MITRE D3FEND and MITRE Engage to select the most suitable cyber deception strategies using the extracted CTI data. Our evaluation encompasses various transformers: SecBERT, SecRoBERTa, SecBERT-BiLSTM-CRF, and SecRoBERTa-BiLSTM-CRF to perform the low-level and highlevel IoCs identification and extraction task, and the multi-label classification task, demonstrating good results.