{"id":"https://openalex.org/W7130696299","doi":"https://doi.org/10.48550/arxiv.2602.17458","title":"The CTI Echo Chamber: Fragmentation, Overlap, and Vendor Specificity in Twenty Years of Cyber Threat Reporting","display_name":"The CTI Echo Chamber: Fragmentation, Overlap, and Vendor Specificity in Twenty Years of Cyber Threat Reporting","publication_year":2026,"publication_date":"2026-02-19","ids":{"openalex":"https://openalex.org/W7130696299","doi":"https://doi.org/10.48550/arxiv.2602.17458"},"language":null,"primary_location":{"id":"pmh:doi:10.48550/arxiv.2602.17458","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":null,"any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5126456107","display_name":"Manuel Suarez-Roman","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Suarez-Roman, Manuel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126451613","display_name":"Francesco Marciori","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Marchiori, Francesco","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126499985","display_name":"Mauro Conti","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Conti, Mauro","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5126525242","display_name":"Juan Tapiador","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tapiador, Juan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5126456107"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.36419999599456787,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.36419999599456787,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.36160001158714294,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12221","display_name":"Cybersecurity and Cyber Warfare Studies","score":0.0640999972820282,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vendor","display_name":"Vendor","score":0.5774000287055969},{"id":"https://openalex.org/keywords/intelligence-analysis","display_name":"Intelligence analysis","score":0.553600013256073},{"id":"https://openalex.org/keywords/situation-awareness","display_name":"Situation awareness","score":0.5376999974250793},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.4887999892234802},{"id":"https://openalex.org/keywords/echo","display_name":"Echo (communications protocol)","score":0.4392000138759613},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.3637000024318695},{"id":"https://openalex.org/keywords/situational-ethics","display_name":"Situational ethics","score":0.288100004196167}],"concepts":[{"id":"https://openalex.org/C2777338717","wikidata":"https://www.wikidata.org/wiki/Q1762621","display_name":"Vendor","level":2,"score":0.5774000287055969},{"id":"https://openalex.org/C517642484","wikidata":"https://www.wikidata.org/wiki/Q2388514","display_name":"Intelligence analysis","level":2,"score":0.553600013256073},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.5376999974250793},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.5073999762535095},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4887999892234802},{"id":"https://openalex.org/C2779426996","wikidata":"https://www.wikidata.org/wiki/Q18389128","display_name":"Echo (communications protocol)","level":2,"score":0.4392000138759613},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4327000081539154},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.3686999976634979},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.3637000024318695},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.36090001463890076},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.31200000643730164},{"id":"https://openalex.org/C9114305","wikidata":"https://www.wikidata.org/wiki/Q1428317","display_name":"Situational ethics","level":2,"score":0.288100004196167},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.2775000035762787},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.26969999074935913},{"id":"https://openalex.org/C46934059","wikidata":"https://www.wikidata.org/wiki/Q61515","display_name":"Outsourcing","level":2,"score":0.2671999931335449},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.26249998807907104},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.25940001010894775},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.25690001249313354},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.2540000081062317}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:doi:10.48550/arxiv.2602.17458","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},{"id":"doi:10.48550/arxiv.2602.17458","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.17458","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"pmh:doi:10.48550/arxiv.2602.17458","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Despite":[0],"the":[1,25,83,109,162,167,177],"high":[2],"volume":[3],"of":[4,12,27,43,85,108,118,179],"open-source":[5,44],"Cyber":[6],"Threat":[7],"Intelligence":[8],"(CTI),":[9],"our":[10,159],"understanding":[11],"long-term":[13],"threat":[14,68,96],"actor-victim":[15],"dynamics":[16],"remains":[17],"fragmented":[18,116],"due":[19],"to":[20,56,98,174],"inconsistent":[21],"reporting":[22,72,128],"standards":[23],"and":[24,58,74,78,89,100,126,172],"lack":[26],"structured":[28],"datasets":[29],"containing":[30],"comprehensive":[31],"analytic":[32],"information.":[33],"In":[34],"this":[35],"paper,":[36],"we":[37,104],"present":[38],"a":[39,52,106,115,144],"large-scale":[40],"automated":[41],"analysis":[42,81,133],"CTI":[45,86,110,168],"reports":[46],"spanning":[47],"two":[48],"decades.":[49],"We":[50,113],"develop":[51],"high-precision,":[53],"LLM-based":[54],"pipeline":[55],"ingest":[57],"structure":[59],"16,096":[60],"reports,":[61],"extracting":[62],"key":[63],"entities":[64],"such":[65],"as":[66],"attributed":[67],"actors,":[69],"motivations,":[70],"victims,":[71],"vendors,":[73],"technical":[75],"indicators":[76],"(IoCs":[77],"TTPs).":[79],"Our":[80,130],"quantifies":[82],"evolution":[84],"information":[87],"density":[88],"specialization,":[90],"characterizing":[91],"patterns":[92],"that":[93,135],"relate":[94],"specific":[95],"actors":[97],"motivations":[99],"victim":[101],"profiles.":[102],"Furthermore,":[103],"perform":[105],"meta-analysis":[107],"industry":[111],"itself.":[112],"identify":[114],"ecosystem":[117],"distinct":[119],"silos":[120],"where":[121],"vendors":[122,139],"demonstrate":[123],"significant":[124],"geographic":[125],"sectoral":[127],"biases.":[129],"marginal":[131],"coverage":[132],"reveals":[134],"intelligence":[136,181],"overlap":[137],"between":[138],"is":[140],"typically":[141],"low:":[142],"while":[143],"few":[145],"core":[146],"providers":[147],"may":[148],"offer":[149],"broad":[150],"situational":[151],"awareness,":[152],"additional":[153],"sources":[154],"yield":[155],"diminishing":[156],"returns.":[157],"Overall,":[158],"findings":[160],"characterize":[161],"structural":[163],"biases":[164],"inherent":[165],"in":[166],"ecosystem,":[169],"enabling":[170],"practitioners":[171],"researchers":[173],"better":[175],"evaluate":[176],"completeness":[178],"their":[180],"sources.":[182]},"counts_by_year":[],"updated_date":"2026-05-23T06:10:36.450269","created_date":"2026-02-21T00:00:00"}