Relation Extraction in Cyber Threat Intelligence: Model-Centric vs. Data-Centric Approaches - PhD Seminar by: Inoussa Mouiche

Abstract: Cyber threat intelligence (CTI) extraction plays a critical role in transforming unstructured reports into structured knowledge for threat detection, analysis, and defense. A central task in this process is relation extraction (RE), which identifies connections between threat entities (e.g., APT29 uses Cobalt Strike). Despite advances in natural language processing, existing methods often struggle with accuracy, generalization, and real-world adoption, limiting their impact on security operations. This seminar explores the tension and synergy between model-centric and data-centric paradigms, using recent advances in CTI extraction as a case study. We introduce the multisequence labeling representation (MSLR), a data-centric method that incorporates expert domain features (human priors), and contrast it with model-centric strategies found in state-of-the-art pipeline and joint optimization models. Our empirical findings show how the two paradigms complement each other, and how enriched data representations not only rival but often surpass architectural complexity in improving RE accuracy.

Keywords: Cyber Threat Intelligence, Model-centric AI, Data-centric AI, Multisequence Labeling Representation, Pipeline Extraction, Joint Extraction, Relation Extraction, Expert Features.