EnhanceCTI: Enhanced semantic filtering and feature extraction framework for industry-specific cyber threat intelligence
EnhanceCTI is an industry-specific cyber threat intelligence framework designed to improve the quality and relevance of threat intelligence. The system integrates DistilBERT-based semantic filtering, high-confidence feature extraction, and a combined judgment model to classify, evaluate, and merge cyber threat information. Using 8,841 threat intelligence reports across eight industries, EnhanceCTI achieved an F1-score of 0.99 for industry classification and 0.97 for intelligence merging decisions. The framework helps cybersecurity analysts efficiently identify relevant threats and reduce redundant intelligence, providing a practical solution for modern threat intelligence platforms.
Fig. 1. Overview of the EnhanceCTI architecture.
Technology Overview
EnhanceCTI combines DistilBERT, SentenceBERT, and Random Forest models to perform industry-specific threat classification, semantic similarity analysis, feature extraction, and intelligence merging. The framework processes OSINT data and automatically identifies relevant, credible, and non-redundant cyber threat intelligence.
Applications & Benefits
The framework supports cybersecurity analysts by improving threat intelligence quality, reducing duplicate information, and enabling industry-specific threat detection. It enhances decision-making, accelerates incident response, and facilitates interoperability with threat intelligence platforms through STIX-based data sharing.
Abstract：
The rapid digitization of various industries has created an urgent need for robust cyber threat intelligence (CTI) systems. Organizations are increasingly developing cyber threat intelligence platforms (TIPs) to gather open-source intelligence (OSINT) and transform it into actionable defenses against information security breaches. However, the overwhelming volume and complexity of OSINT data, often including false or misleading information, pose significant challenges for effective CTI analysis. This study introduces EnhanceCTI, a novel system designed to improve the quality and industry-specific applicability of threat intelligence. EnhanceCTI employs an enhanced bidirectional encoder representations from transformers (DistilBERT)-based semantic filtering method to filter intelligence data and determine its alignment with industry-specific data extracted from TIPs. This filtering is applied across eight major industries: healthcare, finance, government, technology, education, telecommunications, critical infrastructure, and a miscellaneous “others” category. Additionally, EnhanceCTI leverages high-credibility CTI features, integrating them with SentenceBERT to create a merging judgment model. This model determines whether a given piece of intelligence should be merged with existing data or stored independently, thereby ensuring relevance and minimizing redundancy. Finally, a dedicated platform was developed, providing cybersecurity analysts with tools to rapidly assess both intelligence quality and the accuracy of industry-specific classification models. Experimental results demonstrate EnhanceCTI's effectiveness, achieving an F1-score of 0.99 for intelligence identification and a 0.89 cosine Pearson correlation for SentenceBERT. A random forest algorithm, trained on 750 manually annotated samples, achieved an F1-score of 0.97 on the merging judgment model. These findings highlight EnhanceCTI's ability to accurately identify threats, offering a valuable, industry-tailored solution for institutions facing the growing challenges of cybersecurity in the modern digital landscape.
EnhanceCTI: Enhanced semantic filtering and feature extraction framework for industry-specific cyber threat intelligence
Author：Chen Sheng-Shan, Pai Tun-Wen, Sun Chin-Yu
Year：2025
Source publication： Computers and Security, Volume 158, November 2025, 104649
Subfield Highest percentage： 99% Law #5/1162