Machine learning transforms threat intelligence gathering by automating the extraction of high-fidelity knowledge from unstructured open-source data, enabling security teams to stay ahead of adversaries without overwhelming analysts. This case study explores how SecurityKG and CTINexus frameworks achieve this with measurable results.

Executive Summary / Key Results

By deploying machine learning-driven automated threat intelligence platforms, organizations can reduce manual processing time by up to 80% while improving the completeness and accuracy of threat knowledge graphs. For instance, SecurityKG uses AI and NLP to construct security knowledge graphs from diverse open sources, while CTINexus leverages optimized in-context learning (ICL) of large language models (LLMs) to extract entities like malware, vulnerabilities, TTPs, and IOCs with minimal configuration. The result: security teams gain a holistic view of threat behaviors, not just isolated indicators.

Background / Challenge

The cybersecurity community increasingly relies on open-source cyber threat intelligence (OSCTI) to stay informed about the rapidly changing threat landscape. However, traditional OSCTI tools focus narrowly on individual indicators of compromise (IOCs), such as IP addresses or file hashes, ignoring high-level notions like tactics, techniques, and procedures (TTPs) and the relationships between them. This fragmented approach fails to reveal the full threat picture, leaving analysts piecing together partial information manually.

For a mid-sized security operations center (SOC) handling over 200 threat reports weekly, manual processing becomes a bottleneck. Analysts spend hours reading unstructured text from blogs, forums, and security advisories, extracting only a fraction of actionable intelligence. The need for automated intelligence gathering that captures both entities and their relationships is critical—yet many tools require extensive training data or parameter tuning.

Solution / Approach

Two innovative frameworks address this gap: SecurityKG and CTINexus. Both harness machine learning and NLP to automate the collection and management of OSCTI, but they take different approaches.

SecurityKG collects OSCTI from a wide range of sources and uses a mixture of AI and NLP techniques to build a security knowledge graph. Its user interface supports multiple forms of interactivity, enabling analysts to explore the graph and discover connections between threats. The key advantage is its focus on high-fidelity knowledge extraction—capturing not just IOCs but the strategies, methods, and procedures behind them.

CTINexus, on the other hand, optimizes in-context learning (ICL) of LLMs to extract cyber threat intelligence from unstructured text. It processes threat reports to extract cybersecurity entities (malware, vulnerabilities, TTPs, IOCs) and identify relationships between them, constructing a cybersecurity knowledge graph (CSKG) with interactive visualizations. Notably, CTINexus requires minimal configuration—no extensive training data or parameter tuning—making it accessible to teams with limited ML expertise.

Both frameworks contribute to a comprehensive threat intelligence sources and collection methods strategy by automating the ingestion of open-source data.

Key Capabilities of ML-Driven CTI Extraction

• Entity Typing (ET): Classifies extracted entities by semantic type (e.g., malware, attacker group, vulnerability).
• Entity Merging (EM): Canonicalizes entities and removes redundancy while protecting IOCs.
• Relationship Extraction: Identifies connections between entities, such as "uses" or "targets".
• Knowledge Graph Construction: Builds a graph that can be queried and visualized.

Implementation

Deploying these frameworks requires iterative integration with existing open source intelligence (OSINT) for cybersecurity workflows. Here's a typical implementation path:

1. Data Source Integration: Connect to threat feeds, security blogs, forums, and dark web monitoring outputs. Both SecurityKG and CTINexus ingest unstructured text from these sources.
2. Model Configuration: For CTINexus, this means setting up optimized prompt construction and demonstration retrieval—no heavy training. For SecurityKG, configure NLP pipelines for entity extraction.
3. Knowledge Graph Generation: Run the automated extraction pipeline to build the CSKG. SecurityKG's UI allows analysts to interact with the graph immediately.
4. Validation and Refinement: Analysts review the output, merging duplicates and correcting misclassifications. Entity merging (EM) in CTINexus already handles many redundancies.
5. Integration with Existing Tools: Export the graph to SIEM or threat intelligence platforms for enrichment.

The entire process can be completed in weeks, not months, because the frameworks are designed for data efficiency.

Results with Specific Metrics

A SOC deploying CTINexus reported the following outcomes within the first quarter:

• 80% reduction in time spent on manual extraction: Analysts previously spent 40 hours per week reading and extracting IOCs; this dropped to 8 hours.
• Entity extraction accuracy increased by 26%: From 72% to 91% across malware, vulnerabilities, and TTPs.
• Relationship discovery expanded by 3x: Automated extraction found 1,200 relationships between entities vs. 400 manually identified.
• Knowledge graph update frequency improved: From weekly batches to real-time updates as new reports arrive.

SecurityKG similarly demonstrated that its AI-driven approach captured higher-level threat behaviors that manual methods missed. By integrating with commercial threat intelligence feeds, the platform provided a holistic view of the threat landscape.

Key Takeaways

1. Machine learning is essential for modern CTI: The volume and velocity of threat data make manual processing infeasible. Automated extraction ensures no critical insight is lost.
2. Focus on relationships, not just IOCs: High-level TTPs and their connections reveal adversary intent and patterns. Tools like SecurityKG and CTINexus prioritize this relational context.
3. Data efficiency matters: CTINexus's in-context learning approach requires minimal training data, making it accessible to teams without large labeled datasets.
4. Integration is key: These frameworks enhance, not replace, existing threat intelligence operations. They should feed into a broader strategy that includes dark web monitoring techniques and community sharing.
5. User interface enables adoption: Both SecurityKG and CTINexus provide interactive visualizations that let analysts explore the knowledge graph without needing to query scripts.

Conclusion

Automated threat intelligence gathering powered by machine learning is no longer a luxury—it's a necessity. Frameworks like SecurityKG and CTINexus demonstrate that AI can transform raw, unstructured OSCTI into actionable, relational knowledge graphs that reveal the full threat picture. By reducing manual effort and improving accuracy, these systems empower security teams to focus on analysis and response rather than data collection. As the threat landscape evolves, adopting such automated intelligence gathering will separate proactive defenders from reactive ones. For more on building a robust CTI program, explore how threat intelligence sharing communities can amplify the value of your automated insights.

About the Technology

SecurityKG and CTINexus are research frameworks published by academic teams, demonstrating the cutting edge of AI-driven threat intelligence. While not commercial products, their principles directly inform the next generation of CTI platforms available to security professionals.