The DOI matches its Crossref record; 28 of the 29 references it cites were found in a registry or an index.
TRACE: Relationship Analysis and Causal Factor Extraction in Cyber Threat Intelligence Reports
Abstract
Cyber Threat Intelligence (CTI) reports provide valuable insights into cybersecurity attack techniques, which are essential for understanding threat execution. Identifying the root causes of these techniques is crucial for developing effective defense mechanisms. However, the unstructured nature and inconsistent terminology of CTI reports pose significant challenges in extracting causal factors, such as Common Weakness Enumerations (CWEs) and vulnerable data components, limiting proactive responses and the understanding of attack interdependencies. To address these challenges, we propose TRACE, a novel framework that extracts causal factors linked to adversarial techniques and generates comprehensive causal graphs revealing interdependencies within CTI reports. TRACE combines pattern extraction and tagging methods to address the limitations of existing approaches. Utilizing Sentence-based Bidirectional Encoder Representations from Transformers (SBERT) embeddings enhanced with knowledge mappings and deep learning techniques, TRACE discovers and models causal relationships between attack techniques within the reports. By bridging the gap between attack techniques and their underlying vulnerabilities, TRACE provides actionable insights to enhance cybersecurity defenses. Evaluated on 710 CTI reports, TRACE achieved an F1 score of 0.87, demonstrating its accuracy in extracting causal factors and its potential to advance automated causal analysis in cybersecurity.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Furthermore, TRACE[30] even utilizes SBERT to mine semantic dependencies within external unstructured threat intelligence reports.”
From From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps (2026) · cites this paper as [30]
Citations
Cites
RoBERTa: A Robustly Optimized BERT Pretraining Approach
Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., & Stoyanov, V. (2019) · arXiv · doi:10.48550/arxiv.1907.11692 · Cited by 16,515
BERT Post-Training for Review Reading Comprehension and Aspect-based Sentiment AnalysisPreprint
Xu, H., Liu, B., Shu, L., & Yu, P. S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1904.02232 · Cited by 553
CSKG4APT: A Cybersecurity Knowledge Graph for Advanced Persistent Threat Organization Attribution
Ren, Y., Xiao, Y., Zhou, Y., Zhang, Z., & Tian, Z. (2022) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2022.3175719 · Cited by 234
Husari, G., Al-Shaer, E. S., Ahmed, M., Chu, B., & Niu, X. (2017) · Annual Computer Security Applications Conference · doi:10.1145/3134600.3134646 · Cited by 222
AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports
Li, Z., Zeng, J., Chen, Y., & Liang, Z. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17140-6_29 · Cited by 202
Extractor: Extracting Attack Behavior from Threat Reports
Satvat, K., Gjomemo, R., & Venkatakrishnan, V. N. (2021) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp51992.2021.00046 · Cited by 192
The Big Four - What We Did Wrong in Advanced Persistent Threat Detection?
Virvilis, N., & Gritzalis, D. A. (2013) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2013.32 · Cited by 179
Fake News Detection Using Sentiment Analysis
Bhutani, B., Rastogi, N., Sehgal, P., & Purwar, A. (2019) · International Conference on Contemporary Computing · doi:10.1109/ic3.2019.8844880 · Cited by 162
Zhu, Z., & Dumitraş, T. (2018) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp.2018.00039 · Cited by 138
Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI
Alam, T., Bhusal, D., Park, Y. H., & Rastogi, N. (2023) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3607199.3607208 · Cited by 104
Research works printed but not linked: 2
- Shackleford, 2015, Who’s using cyberthreat intelligence and how
- Ding, Applying BERT to long texts, 12792
Cited by
Sorted by citations
NLP-based techniques for Cyber Threat Intelligence
Arazzi, M., Arikkat, D. R., Nicolazzo, S., Nocera, A., A., R. R. K., Vinod, P., & Conti, M. (2025) · Computer Science Review · doi:10.1016/j.cosrev.2025.100765 · Cited by 79
A zero-shot self-improving NER method for cyber threat intelligence via knowledge injection
Jiang, Y., Hu, H., Li, Y., Li, F., Zhao, C., Chen, C., & Liu, Y. (2025) · Cybersecurity · doi:10.1186/s42400-025-00503-0 · Cited by 8
Zeng, Z., Deng, X., & Zhao, B. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3613994 · Cited by 4
Bhanu, S. S., Kumar, J. D. S., Mabuchan, C. V., Sunanda, G., Lakshmi, D., & Rehana, S. (2025) · International Conference on Intelligent Cyber Physical Systems and Internet of Things (ICoICI) · doi:10.1109/icoici65217.2025.11252795 · Cited by 3
MLDSJ: a multi-level feature joint attribution method for APT group based on threat intelligence
Duan, L., Wen, M., & Xiong, Y. (2025) · EURASIP Journal on Information Security · doi:10.1186/s13635-025-00222-6 · Cited by 3
From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps
Zhu, Y., Li, X., Suo, J., Yin, Y., & Huang, C. (2026) · 2026 International Conference on AI in Education Technology and Applications (AIETA) · doi:10.1109/aieta69357.2026.11508946
GAI & cybersecurity: Bi-visions
Taher, A. B., Fourati, L. C., & Ayed, S. (2026) · Computer Science Review · doi:10.1016/j.cosrev.2026.100940
IG-GAT for fault tracing: A fault propagation intensity-guided graph attention network model
Wang, Y., Yang, C., Ma, H., Xu, P., & Liu, Z. (2026) · Applied Soft Computing · doi:10.1016/j.asoc.2026.116042
Yang, C. R., Bao, J., Shang, Y., Ding, H., Guo, Q., Liao, Y., Zhou, R., & Xiong, N. N. (2026) · IET Communications · doi:10.1049/cmu2.70187
Automatic Construction of Cyber Attack Chains via Semantic Enhancement and Causal Reasoning
Li, R., Ye, S., Zhuang, J., Bu, Z., Ge, Y., & Li, J. (2026) · International Conference on Electronics Technology (ICET) · doi:10.1109/icet69987.2026.11659238
CRe-CoT: Enhanced Chain-of-Thought Reasoning for Cyber Threat Intelligence Relation Extraction
Ma, J., & Han, W. (2026) · International Conference on Machine Learning and Intelligent Computing · doi:10.1145/3829441.3829448
Wang, Y., Yang, C., Yao, J., Zhao, Y., & Liu, Z. (2026) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2026.113624
Dynamic Causal Attack Graph Modeling and Predictive Cyber Threat Forecasting
Sumalatha, M. R., & Harshitha, G. S. (2026) · doi:10.1109/click68749.2026.11742027
Metadata
- Authors
- Vaitheeshwari, R., Wu, E. H.-K., Lin, Y.-D., Hwang, R.-H., Lin, P.-C., Lai, Y.-C., & Ali, A.
- Affiliations
- National Central University (TW)
- National Yang Ming Chiao Tung University (TW)
- National Chung Cheng University (TW)
- National Taiwan University of Science and Technology (TW)
- National Institute of Cyber Security, Ministry of Digital Affairs, Taipei, Taiwan
- ORCID
- Venue
- IEEE Transactions on Dependable and Secure Computing
- Published
- 2025-07
- Volume
- 22
- Issue
- 4
- Pages
- 3544-3560
- ISSN
- 1545-5971 (ISSN-L)
- 1941-0018
- 2160-9209
- OpenAlex
- W4406753679
- Cited by
- 12
- References
- 29
- Citations by year
- 2026: 7 · 2025: 5
- FWCI
- 12.58
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Dependable and Secure Computing (publishedVersion)
- Funders
- Cybersecurity Center of Excellence
- National Science and Technology Council
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- causal graphs, attack techniques, Common Weakness Enumeration, vulnerability detection, SBERT embeddings, knowledge mapping, pattern extraction, unstructured text analysis, cyber defense
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
