Extraction of entities from cyber threat intelligence reports using large language models

Гусейнли, А.

Рақамли технологияларнинг назарий ва амалий масалалари · 2026-yil

Annotatsiya

Cyber Threat Intelligence reports combine analytical prose with dense technical indicators, making structured entity extraction a challenging but operationally valuable task. This paper presents a comparative evaluation of three large language models - Claude Sonnet 4.6, GPT-5.4, and LLaMA 4 Scout - on a manually annotated corpus of 21 real-world CTI reports across 15 entity types and 1284 ground truth instances. The paper evaluates zero-shot and few-shot prompting conditions and studies the effect of iterative prompt refinement, focusing on explicit format constraints for cryptographic hash entities. Results show that Claude Sonnet 4.6 and GPT-5.4 achieve comparable performance under zero-shot conditions, with LLaMA 4 Scout trailing by a substantial margin. Few-shot prompting consistently reduces hallucination rates but yields mixed F1 results, with exemplar cardinality emerging as a critical design factor. Entity extraction difficulty varies substantially across types, with technical indicator categories showing near-perfect performance and semantic categories such as tool and target sector posing the greatest challenges across all evaluated models.

Maqola ma’lumotlari
MualliflarГусейнли, А.
JurnalРақамли технологияларнинг назарий ва амалий масалалари
NashriyotТАТУ Самарқанд филиали
ISSN2181-3086, 2181-3094
Nashr sanasi2026-08-03
Jild9
Son3
Betlar7-15
TilIngliz
Ilmiy sohaTexnika
DOI10.62132/ijdt.v9i3.393
Indeksga qo‘shilgan2026-08-26

DOI: 10.62132/ijdt.v9i3.393 · Maqolaning asl sahifasi

Kalit so‘zlar

киберразведка, распознавание именованных сущностей, большие языковые модели, инженерия промптов, cyber threat intelligence, named entity recognition, large language models, prompt engineering

Ilmiy soha

Texnika

Iqtibos keltirish

APAГусейнли, А. (2026). Extraction of entities from cyber threat intelligence reports using large language models. Рақамли технологияларнинг назарий ва амалий масалалари, 9(3), 7-15. https://doi.org/10.62132/ijdt.v9i3.393
GOST (OAK)Гусейнли, А. Extraction of entities from cyber threat intelligence reports using large language models // Рақамли технологияларнинг назарий ва амалий масалалари. – 2026. – T. 9, № 3. – P. 7-15. – DOI: 10.62132/ijdt.v9i3.393.
MLAГусейнли, А. “Extraction of entities from cyber threat intelligence reports using large language models.” Рақамли технологияларнинг назарий ва амалий масалалари, 9(3), 7-15, 2026. https://doi.org/10.62132/ijdt.v9i3.393
ChicagoГусейнли, А. “Extraction of entities from cyber threat intelligence reports using large language models.” Рақамли технологияларнинг назарий ва амалий масалалари, 9(3), 7-15 (2026). https://doi.org/10.62132/ijdt.v9i3.393
HarvardГусейнли, А (2026) ‘Extraction of entities from cyber threat intelligence reports using large language models’, Рақамли технологияларнинг назарий ва амалий масалалари, 9(3), 7-15. https://doi.org/10.62132/ijdt.v9i3.393
BibTeX
@article{article2026,
  title = {Extraction of entities from cyber threat intelligence reports using large language models},
  author = {Гусейнли, А.},
  journal = {Рақамли технологияларнинг назарий ва амалий масалалари},
  year = {2026},
  volume = {9},
  number = {3},
  pages = {7-15},
  doi = {10.62132/ijdt.v9i3.393},
  url = {https://doi.org/10.62132/ijdt.v9i3.393}
}

Boshqa maqola uchun iqtibos tayyorlash

Рақамли технологияларнинг назарий ва амалий масалалари jurnalidan boshqa maqolalar

Рақамли технологияларнинг назарий ва амалий масалалари — barcha maqolalar · 2026-yil arxivi

Texnika sohasidagi boshqa maqolalar

Texnika sohasidagi OAK jurnallari