S-AECR: Word Intelligence and Explanation Strategy for Cyber Threat Intelligence Extraction and Mapping

Abstract

Cyber Threat Intelligence (CTI) reports are the primary source of actionable threat knowledge; however, most high-value content is published in unstructured text, creating a significant bottleneck for operational threat response. Manual extraction of Indicators of Compromise (IoC), cybersecurity entities, and Tactics, Techniques, and Procedures (TTP) mapped to the MITRE ATT&CK framework is labor-intensive and difficult to scale. This paper presents S-AECR (Split-NER + Semantically-Aware Attack Extraction and Cyber-threat Recognition), a modular end-to-end pipeline that converts raw CTI reports into structured intelligence. S-AECR comprises four stages: multi-format preprocessing, Word Intelligence Collection (regex-based IoC extraction with defanging recovery, Aho-Corasick entity matching, and two-stage Split-NER for nine entity types), binary sentence filtration, and 168-class ATT&CK technique identification. A core contribution is the Explanation Strategy, which enriches each sentence with natural-language prefixes that semantically annotate extracted IoC spans, thereby providing BERT with explicit domain context before classification. Evaluated on 128 real-world CTI reports (28,646 sentences for filtration and 10,146 sentences for identification), S-AECR achieves a Macro F1 of 0.9106 on sentence filtration and 0.4162 on technique identification. It consistently outperforms five recent pipelines (Orbinato, TRAM, TIEF, ALERT, and AECR). Ablation studies confirm that Word Intelligence enrichment is the most impactful component, with its removal causing a 19.3% drop in Macro F1.