CTI 回声室：二十年来网络威胁报告中的碎片化、重叠与供应商特定性
The CTI Echo Chamber: Fragmentation, Overlap, and Vendor Specificity in Twenty Years of Cyber Threat Reporting
AI总结：
本文研究了二十年来网络威胁报告中的碎片化、重叠和供应商特定性问题，通过大规模自动化分析揭示了CTI信息密度和专业性的演变，识别了CTI行业中的碎片化生态系统和供应商的地理和行业偏见。
摘要：
尽管开源网络威胁情报（CTI）的体积庞大，但长期威胁行为者-受害者动态仍因报告标准不一致和缺乏包含全面分析信息的结构化数据集而碎片化。本文提出了一种大规模自动化分析，分析了跨度二十年的开源CTI报告。我们开发了一种高精度、基于大语言模型的管道，用于摄入和结构化16,096份报告，提取关键实体，如归因的威胁行为者、动机、受害者、报告供应商和技术指标（IoCs和TTPs）。我们的分析量化了CTI信息密度和专业性的演变，刻画了与特定威胁行为者相关联的动机和受害者特征的模式。此外，我们对CTI行业本身进行了元分析。我们识别出一个碎片化的生态系统，其中供应商表现出显著的地理和行业报告偏见。我们的边缘覆盖分析表明，供应商之间的情报重叠通常很低：虽然少数核心供应商可能提供广泛的态势感知，但额外来源的收益逐渐减少。总体而言，我们的发现描述了CTI生态系统中固有的偏见，使从业者和研究者能够更好地评估其情报来源的完整性。
英文摘要：
Despite the high volume of open-source Cyber Threat Intelligence (CTI), our understanding of long-term threat actor-victim dynamics remains fragmented due to inconsistent reporting standards and the lack of structured datasets containing comprehensive analytic information. In this paper, we present a large-scale automated analysis of open-source CTI reports spanning two decades. We develop a high-precision, LLM-based pipeline to ingest and structure 16,096 reports, extracting key entities such as attributed threat actors, motivations, victims, reporting vendors, and technical indicators (IoCs and TTPs). Our analysis quantifies the evolution of CTI information density and specialization, characterizing patterns that relate specific threat actors to motivations and victim profiles. Furthermore, we perform a meta-analysis of the CTI industry itself. We identify a fragmented ecosystem of distinct silos where vendors demonstrate significant geographic and sectoral reporting biases. Our marginal coverage analysis reveals that intelligence overlap between vendors is typically low: while a few core providers may offer broad situational awareness, additional sources yield diminishing returns. Overall, our findings characterize the structural biases inherent in the CTI ecosystem, enabling practitioners and researchers to better evaluate the completeness of their intelligence sources.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
