A Structured Workflow for Transforming Cyber Threat Intelligence into Computable Detection Patterns

Area of Science:

• Cybersecurity
• Computational Linguistics
• Information Security

Background:

• Security Operations Centers (SOCs) face challenges converting cyber threat intelligence (CTI) into operational detection rules.
• Automated extraction of indicators of compromise (IOCs) is improving, but their translation into validated regular expressions (regexes) remains a manual and error-prone bottleneck.

Purpose of the Study:

• To establish a standardized and reproducible protocol for translating extracted IOCs into deployable regex patterns.
• To overcome the limitations of manual IOC-to-regex conversion, enhancing efficiency and accuracy in SOC workflows.

Main Methods:

• A five-stage workflow: CTI report parsing, multi-LLM IOC extraction with consensus, rule-based IOC normalization and deduplication, graph-assisted component labeling, and iterative regex generation with validation.
• Application to 3,156 CTI reports and evaluation against over 2,400 ground-truth strings from MITRE ATT&CK scenarios.

Main Results:

• Achieved an average hit rate of 99.1% in regex validation against ground-truth data.
• Demonstrated an average cross-IOC mismatch rate of only 0.8%, indicating high precision.
• Successfully applied the protocol to a large corpus of CTI reports.

Conclusions:

• The developed protocol offers a reproducible method for IOC-to-regex translation, addressing a critical gap in cybersecurity detection content generation.
• The workflow enhances the automation and reliability of transforming threat intelligence into actionable SIEM correlation rules.
• The study delineates the protocol's scope, assumptions, and limitations for practical implementation in SOC environments.