Scholarlink

Cyber Threat Intelligence (CTI) has become an indispensable element of cybersecurity operations and any mechanism or tool that alleviates the workload of security analysts is highly valuable. Natural Language Processing (NLP) supports efficient processing of news articles, and enables us to group articles that report about the same story. This allows Open Source Intelligence (OSINT) analysts to manage information overload and focus only on essential events. Therefore, the contributions of this paper are manyfold: (i) We identify the relevant requirements for designing an OSINT clustering tool, (ii) present a solution that can support such requirements, and (iii) evaluate the solution considering the needs of OSINT analysts. Our clustering approach, denoted as SC4OSINT, is inspired by an existing semi-supervised graph-based story clustering method and adapted to the OSINT requirements. Unlike the original method, SC4OSINT is a fully unsupervised two-layer approach, which handles multilingual streaming data and uses sentence transformers to create fine-grained clusters. We evaluate SC4OSINT’s story clustering by letting security experts rate the clustering quality across various model configurations. The results show that the best hyper-parameter configuration achieves an average rating of 4.19/5, demonstrating the efficiency of our approach.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

SC4OSINT: A Story Clustering Approach to Optimize OSINT Analysis

  • 会议论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年

查看全文
  • Elisabeth Woisetschläger,
  • Medina Andresel,
  • Florian Skopik,
  • Benjamin Akhras,
  • Peter Leitmann,
  • Max Landauer,
  • Markus Wurzenberger,
  • Alexander Schindler

摘要

Cyber Threat Intelligence (CTI) has become an indispensable element of cybersecurity operations and any mechanism or tool that alleviates the workload of security analysts is highly valuable. Natural Language Processing (NLP) supports efficient processing of news articles, and enables us to group articles that report about the same story. This allows Open Source Intelligence (OSINT) analysts to manage information overload and focus only on essential events. Therefore, the contributions of this paper are manyfold: (i) We identify the relevant requirements for designing an OSINT clustering tool, (ii) present a solution that can support such requirements, and (iii) evaluate the solution considering the needs of OSINT analysts. Our clustering approach, denoted as SC4OSINT, is inspired by an existing semi-supervised graph-based story clustering method and adapted to the OSINT requirements. Unlike the original method, SC4OSINT is a fully unsupervised two-layer approach, which handles multilingual streaming data and uses sentence transformers to create fine-grained clusters. We evaluate SC4OSINT’s story clustering by letting security experts rate the clustering quality across various model configurations. The results show that the best hyper-parameter configuration achieves an average rating of 4.19/5, demonstrating the efficiency of our approach.