TIBlender：来自跨平台社交媒体证据的早期预警威胁情报
TIBlender: Early-Warning Threat Intelligence from Cross-Platform Social Media Evidence
AI总结：
提出多智能体系统TIBlender，通过角色专业化LLM代理整合四个社交媒体平台的威胁信号，生成结构化威胁情报报告，在真实部署中提前检测到所有四类威胁，且大多数IoC未被现有情报源覆盖。
摘要：
网络威胁信号分散在多个社交媒体平台上，但目前尚无现有方法能将其完全自动化整合为可操作的威胁情报（TI）报告。我们提出TIBlender，一个多智能体系统，监控四个平台（X、Reddit、Telegram和Discord），并通过角色专业化的LLM代理生成结构化TI报告。这些代理进行多视角调查，通过协作、基于证据的分析追踪证据链，以揭示相关的入侵指标（IoC）。在实际部署中，TIBlender在公开情报源之前检测到所有四类威胁类别的新兴威胁，包括在公共漏洞注册表之前检测到野外利用；其大部分IoC在评估的每个情报源中均未出现。定量评估证实，每个平台贡献了其他平台无法获得的独特威胁信息，且排除任何一个平台都会导致特定威胁类别的报告大量损失。在相同的单平台输入条件下，TIBlender的IoC提取达到或超过每个基线；完整流程提取的IoC显著更多，其中大部分在任何单平台基线中都不存在。这些结果确立了跨平台社交媒体监控作为运营TI管道的有效且可扩展的早期预警层。
英文摘要：
Cyber threat signals are fragmented across multiple social media platforms, yet no existing approach has fully automated their integration into actionable threat intelligence (TI) reports. We present TIBlender, a multi-agent system that monitors four platforms (X, Reddit, Telegram, and Discord) and produces structured TI reports via role-specialized LLM agents. These agents conduct multi-perspective investigations, tracing chains of evidence to uncover related Indicators of Compromise (IoCs) via collaborative, evidence-backed analysis. In a real-world deployment, TIBlender detected emerging threats across all four threat categories ahead of public feeds, including in-the-wild exploitation ahead of public vulnerability registries; the majority of its IoCs were absent from each evaluated feed. Quantitative evaluation confirms that each platform contributes unique threat information unavailable from the others, and that excluding any single platform results in substantial loss of reports in specific threat categories. Under identical single-platform input conditions, TIBlender's direct extraction produced substantially different IoC sets from the corresponding platform-specific baselines, while multi-perspective investigation further enriched the resulting intelligence. These results establish cross-platform social media monitoring as an effective and scalable early-warning layer for operational TI pipelines.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
