标题： 从文本到可操作的智能：自动化STIX实体和关系提取 显示英文标题

标题： From Text to Actionable Intelligence: Automating STIX Entity and Relationship Extraction

摘要： 共享攻击方法及其有效性是构建强大防御系统的核心。 由不同个人和组织生成的威胁分析报告在支持安全操作和应对新兴威胁方面发挥着关键作用。 为了提高威胁情报共享的及时性和自动化程度，已经制定了几种标准，其中结构化威胁信息表达（STIX）框架成为最广泛采用的一种。 然而，从非结构化安全文本生成兼容STIX的数据仍然主要是一个手动、专家驱动的过程。 为了解决这个挑战，我们引入了AZERG，一种旨在帮助安全分析师自动生成结构化STIX表示的工具。 为此，我们将通用的大语言模型适应于提取STIX格式威胁数据的特定任务。 为了管理复杂性，该任务被分为四个子任务：实体检测（T1），实体类型识别（T2），相关对检测（T3）和关系类型识别（T4）。 我们应用了任务特定的微调，以准确提取符合STIX规范的相关实体并推断它们之间的关系。 为了解决训练数据不足的问题，我们整理了一个全面的数据集，其中包含从141份完整的威胁分析报告中提取的4,011个实体和2,075个关系，并且所有数据都按照STIX标准进行注释。 我们的模型在现实场景中的F1得分分别为T1的84.43%，T2的88.49%，T3的95.47%和T4的84.60%。 我们将其性能与一系列开放参数和封闭参数模型以及最先进的方法进行了验证，结果显示各项任务的性能提高了2-25%。 显示英文摘要

摘要： Sharing methods of attack and their effectiveness is a cornerstone of building robust defensive systems. Threat analysis reports, produced by various individuals and organizations, play a critical role in supporting security operations and combating emerging threats. To enhance the timeliness and automation of threat intelligence sharing, several standards have been established, with the Structured Threat Information Expression (STIX) framework emerging as one of the most widely adopted. However, generating STIX-compatible data from unstructured security text remains a largely manual, expert-driven process. To address this challenge, we introduce AZERG, a tool designed to assist security analysts in automatically generating structured STIX representations. To achieve this, we adapt general-purpose large language models for the specific task of extracting STIX-formatted threat data. To manage the complexity, the task is divided into four subtasks: entity detection (T1), entity type identification (T2), related pair detection (T3), and relationship type identification (T4). We apply task-specific fine-tuning to accurately extract relevant entities and infer their relationships in accordance with the STIX specification. To address the lack of training data, we compiled a comprehensive dataset with 4,011 entities and 2,075 relationships extracted from 141 full threat analysis reports, all annotated in alignment with the STIX standard. Our models achieved F1-scores of 84.43% for T1, 88.49% for T2, 95.47% for T3, and 84.60% for T4 in real-world scenarios. We validated their performance against a range of open- and closed-parameter models, as well as state-of-the-art methods, demonstrating improvements of 2-25% across tasks.