DeBERTaIC: A Framework for Cyber Threat Analysis Integrating DeBERTa Model and Attack Intelligence Chain

As the Internet of Things (IoT) technology advances, the Consumer Electronics (CE) sector is experiencing continuous growth, with more and more CE devices connecting to the network. This has led to an expansion of the attack surface and an increase in cyber threats, posing challenges to traditional network security defenses. Consequently, many organizations have started to use Cyber Threat Intelligence (CTI) to counter emerging cyber threats in a timely manner. However, current methods still face issues with balancing analysis accuracy and efficiency, as well as difficulties in visual presentation. To address these issues, this paper presents DeBERTaIC, a technical framework for analyzing and visualizing cyber attacks in CE networks. First, we develop a DeBERTa-BiGRU-CRF model for named entity recognition. DeBERTa’s strong contextual understanding enables accurate identification of entity boundaries and extraction of key named entity information related to cyber attacks. Second, we design a DeBERTa -SVD -LightGBM model for attack-type recognition. Singular Value Decomposition (SVD) is used to extract input text features, and LightGBM is employed for rapid classification to ensure efficiency. Finally, by integrating information from the first two steps, we construct an attack intelligence chain based on the ATT&CK framework, graphically presenting attack sources, paths, targets, and types. This provides an intuitive analysis tool for decision makers to identify threats and formulate defense strategies. Experimental results confirm the effectiveness of our approach. The method used in this paper generally outperforms other models in terms of threat classification prediction accuracy and recall rate, with average values reaching 98.49% and 94.9%, respectively. Moreover, this method ensures efficient operation, providing a new perspective and tool for CE network security protection.