{"id":"https://openalex.org/W7204614275","doi":null,"title":"Towards Reliable Large Language Models for Cyber Threat Intelligence","display_name":"Towards Reliable Large Language Models for Cyber Threat Intelligence","publication_year":2026,"publication_date":"2026-07-01","ids":{"openalex":"https://openalex.org/W7204614275"},"language":"en","primary_location":{"id":"pmh:oai:repository.rit.edu:theses-13904","doi":null,"is_oa":true,"landing_page_url":"https://repository.rit.edu/theses/12773","pdf_url":"https://repository.rit.edu/cgi/viewcontent.cgi?article=13904&context=theses","source":{"id":"https://openalex.org/S4306402456","display_name":"RIT Scholar Works (Rochester Institute of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I155173764","host_organization_name":"Rochester Institute of Technology","host_organization_lineage":["https://openalex.org/I155173764"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Theses","raw_type":"text"},"volume":null,"type":"dissertation","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://repository.rit.edu/cgi/viewcontent.cgi?article=13904&context=theses","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133819644","display_name":"Md Tanvirul Alam","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I155173764","display_name":"Rochester Institute of Technology","ror":"https://ror.org/00v4yb702","country_code":"US","type":"education","lineage":["https://openalex.org/I155173764"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Alam, Md Tanvirul","raw_affiliation_strings":["Rochester Institute of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Rochester Institute of Technology","institution_ids":["https://openalex.org/I155173764"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5133819644"],"corresponding_institution_ids":["https://openalex.org/I155173764"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.42820000648498535,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.42820000648498535,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.26339998841285706,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.10400000214576721,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cyber-threat-intelligence","display_name":"cyber threat intelligence","score":0.984000027179718},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9990000128746033},{"id":"https://openalex.org/keywords/knowledge-graph-construction","display_name":"knowledge graph construction","score":0.6510000228881836},{"id":"https://openalex.org/keywords/llm-benchmarking","display_name":"LLM benchmarking","score":0.6190000176429749},{"id":"https://openalex.org/keywords/reinforcement-learning-with-verifiable-rewards","display_name":"reinforcement learning with verifiable rewards","score":0.875},{"id":"https://openalex.org/keywords/self-training","display_name":"self-training","score":0.9279999732971191}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7513999938964844},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.5349000096321106},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5054000020027161},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.47699999809265137},{"id":"https://openalex.org/C85847156","wikidata":"https://www.wikidata.org/wiki/Q59015987","display_name":"Verifiable secret sharing","level":3,"score":0.46050000190734863},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.4068000018596649},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.3912999927997589},{"id":"https://openalex.org/C517642484","wikidata":"https://www.wikidata.org/wiki/Q2388514","display_name":"Intelligence analysis","level":2,"score":0.38830000162124634},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3806999921798706},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.37290000915527344},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.35530000925064087},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.35089999437332153},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.32179999351501465},{"id":"https://openalex.org/C207685749","wikidata":"https://www.wikidata.org/wiki/Q2088941","display_name":"Domain knowledge","level":2,"score":0.3172000050544739},{"id":"https://openalex.org/C2777220311","wikidata":"https://www.wikidata.org/wiki/Q6423340","display_name":"Knowledge acquisition","level":2,"score":0.29760000109672546},{"id":"https://openalex.org/C2780428219","wikidata":"https://www.wikidata.org/wiki/Q16952335","display_name":"Cover (algebra)","level":2,"score":0.2904999852180481},{"id":"https://openalex.org/C105409693","wikidata":"https://www.wikidata.org/wiki/Q5937824","display_name":"Human intelligence","level":2,"score":0.2897000014781952},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.27880001068115234},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.27399998903274536},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.271699994802475},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.2711000144481659},{"id":"https://openalex.org/C201638289","wikidata":"https://www.wikidata.org/wiki/Q457396","display_name":"Ambient intelligence","level":2,"score":0.26649999618530273},{"id":"https://openalex.org/C22367795","wikidata":"https://www.wikidata.org/wiki/Q7625208","display_name":"Structured prediction","level":2,"score":0.2551000118255615},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2531000077724457}],"mesh":[],"locations_count":1,"locations":[{"id":"pmh:oai:repository.rit.edu:theses-13904","doi":null,"is_oa":true,"landing_page_url":"https://repository.rit.edu/theses/12773","pdf_url":"https://repository.rit.edu/cgi/viewcontent.cgi?article=13904&context=theses","source":{"id":"https://openalex.org/S4306402456","display_name":"RIT Scholar Works (Rochester Institute of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I155173764","host_organization_name":"Rochester Institute of Technology","host_organization_lineage":["https://openalex.org/I155173764"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Theses","raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:repository.rit.edu:theses-13904","doi":null,"is_oa":true,"landing_page_url":"https://repository.rit.edu/theses/12773","pdf_url":"https://repository.rit.edu/cgi/viewcontent.cgi?article=13904&context=theses","source":{"id":"https://openalex.org/S4306402456","display_name":"RIT Scholar Works (Rochester Institute of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I155173764","host_organization_name":"Rochester Institute of Technology","host_organization_lineage":["https://openalex.org/I155173764"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Theses","raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204614275.pdf","grobid_xml":"https://content.openalex.org/works/W7204614275.grobid-xml"},"referenced_works_count":42,"referenced_works":["https://openalex.org/W2736601468","https://openalex.org/W2799054028","https://openalex.org/W2971869958","https://openalex.org/W3030163527","https://openalex.org/W3083410900","https://openalex.org/W4223518423","https://openalex.org/W4320003957","https://openalex.org/W4327810158","https://openalex.org/W4384918448","https://openalex.org/W4387561528","https://openalex.org/W4388718089","https://openalex.org/W4389519254","https://openalex.org/W4389599215","https://openalex.org/W4390306856","https://openalex.org/W4391212671","https://openalex.org/W4391631327","https://openalex.org/W4392539041","https://openalex.org/W4395064704","https://openalex.org/W4396788086","https://openalex.org/W4404987271","https://openalex.org/W4405957102","https://openalex.org/W4407186287","https://openalex.org/W4409348001","https://openalex.org/W4414281281","https://openalex.org/W4414594130","https://openalex.org/W4415013324","https://openalex.org/W4415311663","https://openalex.org/W4415914377","https://openalex.org/W4415914641","https://openalex.org/W4415914961","https://openalex.org/W4416556500","https://openalex.org/W6962937750","https://openalex.org/W7083309452","https://openalex.org/W7083683602","https://openalex.org/W7092294014","https://openalex.org/W7117292443","https://openalex.org/W7126213966","https://openalex.org/W7127267186","https://openalex.org/W7138345725","https://openalex.org/W7154232338","https://openalex.org/W7166887355","https://openalex.org/W7196963086"],"related_works":["https://openalex.org/W4413240969","https://openalex.org/W4415257529","https://openalex.org/W7221148215","https://openalex.org/W4413250014","https://openalex.org/W7083828117","https://openalex.org/W7154268783","https://openalex.org/W7127267186","https://openalex.org/W4415797703","https://openalex.org/W4396788086","https://openalex.org/W7134968946"],"abstract_inverted_index":{"Cyber":[0],"Threat":[1],"Intelligence":[2],"(CTI)":[3],"helps":[4],"security":[5,36],"analysts":[6],"respond":[7],"to":[8,120,214],"evolving":[9],"threats,":[10],"but":[11],"the":[12,125,189,236],"evidence":[13],"it":[14,175],"draws":[15],"on":[16,134,202,257],"is":[17,226],"often":[18],"scattered":[19],"across":[20,154,241],"noisy":[21],"reports,":[22],"advisories,":[23],"and":[24,50,63,93,95,104,118,149,151,157,183,243,262],"threat":[25,59,78,98],"descriptions.":[26],"Large":[27],"language":[28,172],"models":[29],"(LLMs)":[30],"provide":[31],"a":[32,97,197],"flexible":[33],"interface":[34],"for":[35,102],"analysis,":[37],"yet":[38],"reliable":[39,164,251],"use":[40,253],"requires":[41],"grounding":[42],"their":[43],"outputs":[44],"in":[45,254,266],"source":[46],"evidence,":[47],"domain":[48,232,268],"schemas,":[49],"CTI":[51,71,135,158,165,198,212,255],"standards.":[52],"We":[53,80,107],"address":[54],"this":[55,221],"problem":[56,146],"through":[57,137,179],"structured":[58,77,127,145,211,231,258],"representation,":[60],"task-specific":[61,184],"evaluation,":[62,261],"verifier-guided":[64],"post-training.":[65],"First,":[66],"we":[67,130,195],"study":[68],"how":[69],"unstructured":[70],"reports":[72],"can":[73,234],"be":[74,168,177],"converted":[75],"into":[76],"knowledge.":[79,269],"develop":[81,196],"an":[82,110],"ontology-guided":[83],"extraction":[84,148],"framework":[85,200,209],"that":[86,113,163,230,250],"normalizes":[87],"attack":[88],"patterns,":[89],"extracts":[90],"typed":[91,122],"entities":[92],"relations,":[94],"constructs":[96],"intelligence":[99],"knowledge":[100,233],"graph":[101],"querying":[103],"link":[105],"prediction.":[106],"also":[108],"examine":[109],"LLM-based":[111],"extension":[112],"uses":[114,210],"prompting,":[115],"constrained":[116],"generation,":[117],"fine-tuning":[119],"produce":[121],"triples":[123],"within":[124],"same":[126],"representation.":[128],"Second,":[129],"investigate":[131],"LLM":[132,252],"capabilities":[133],"tasks":[136,182,242],"systematic":[138],"benchmarking.":[139],"The":[140,208],"benchmarks":[141],"cover":[142],"closed-form":[143],"knowledge,":[144],"solving,":[147],"mapping,":[150],"open-ended":[152],"reasoning":[153],"cybersecurity":[155],"advisory":[156],"analysis":[159],"tasks.":[160],"Results":[161],"show":[162,229,249],"performance":[166],"cannot":[167],"inferred":[169],"from":[170],"general":[171],"ability":[173],"alone;":[174],"must":[176],"measured":[178],"concrete":[180],"analyst-facing":[181],"metrics.":[185],"Finally,":[186],"motivated":[187],"by":[188,193],"capability":[190],"gaps":[191],"revealed":[192],"benchmarking,":[194],"post-training":[199],"based":[201],"reinforcement":[203],"learning":[204],"with":[205],"verifiable":[206,267],"rewards.":[207],"targets":[213],"guide":[215,235],"model":[216,244],"adaptation,":[217],"while":[218],"self-training":[219],"supplements":[220],"process":[222],"when":[223],"verifier":[224],"feedback":[225],"sparse.":[227],"Experiments":[228],"adaptation":[237],"of":[238],"CTI-specialized":[239],"LLMs":[240],"backbones.":[245],"Together,":[246],"these":[247],"contributions":[248],"depends":[256],"representations,":[259],"task-grounded":[260],"training":[263],"signals":[264],"grounded":[265]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-08-29T00:00:00"}