How Does TIEF Work, the New Brain That Reads Cyber Threat Reports?

The digital world is increasingly flooded by complex cyber attacks. To defend themselves, companies need to quickly understand the tactics, techniques, and procedures (TTP) used by hackers. Until recently, extracting this information from textual reports was a manual, slow, and error‑prone task. This is where the Threat Intelligence Extraction Framework, or TIEF, steps in.

TIEF is an AI‑powered system that automatically reads threat reports and identifies Indicators of Compromise (IOCs), such as suspicious IP addresses or malicious file hashes. Its core is DistilBERT, a lighter version of the famous BERT model, achieving an F1 score of 0.933 while using 40% fewer parameters than BERT‑base.

But TIEF does more than simple classification. Using BERTopic, it clusters semantically similar paragraphs, capturing the varied narrative styles of reports. The output is a standardized STIX 2.1 representation, ready for sharing across security platforms. In practice, TIEF turns a technical document into a detailed map of the adversary’s moves, enabling faster and more precise response. It represents a major leap for cyber‑defense, streamlining analysts’ work.

The DistilBERT model at the core of TIEF was obtained through knowledge distillation from BERT‑base, reducing parameters from 110 M to roughly 66 M while losing less than 3% accuracy. This compression is crucial for deployment in resource‑constrained environments, such as on‑premise SOCs (Security Operations Centers). The multi‑label classification stage employs a Binary Cross‑Entropy loss with class‑frequency inverse weighting, mitigating the imbalanced data issue typical of MITRE ATT&CK datasets, where common techniques (e.g., Phishing) dominate over rare ones (e.g., Exploit Public‑Facing Application).

BERTopic, integrated into TIEF, uses sentence‑transformer embeddings to build a similarity matrix followed by HDBSCAN clustering. This approach identifies groups of semantically related sentences, facilitating extraction of sub‑techniques and their mapping onto ATT&CK. Moreover, TIEF translates extracted IOCs into STIX 2.1, adhering to JSON serialization standards and object relationships (Indicator, Relationship, Attack‑Pattern). The result is an interoperable bundle ready for ingestion into platforms like MISP or OpenCTI, enhancing intelligence sharing at national and international levels.

From a computational standpoint, TIEF is optimized for Nvidia RTX 3080 GPUs, achieving an average throughput of 12 reports per minute with inference latency below 500 ms per report. This makes the framework suitable for both batch processing (retrospective analysis) and real‑time pipelines, where speed is essential to contain emerging threats.