@inproceedings{jaffal-etal-2026-smah,
title = "{SMAH}-{CTI}: A Unified Sentence-Level Benchmark for Multi-Task Cyber Threat Intelligence Extraction",
author = "Jaffal, Niveen Omar and
Jarrar, Radi and
Alkhanafseh, Mohammed and
Mohaisen, David",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.1180/",
doi = "10.18653/2026.findings-emnlp.1180",
pages = "24937--24955",
ISBN = "979-8-89176-462-0",
abstract = "Cyber Threat Intelligence (CTI) reports describe adversary behavior and attack infrastructure in natural language but remain largely unstructured and difficult to process at scale. Existing CTI benchmarks are limited in realism or scope, often relying on synthetic or knowledge-base-derived data, coarse document-level annotations, or isolated subtasks. We introduce SMAH-CTI, a human-annotated benchmark derived from 100 public CTI reports from five threat intelligence providers. It contains 12,304 validated sentence-level instances annotated for (i) relevance classification, (ii) CTI-specific named entity recognition (NER), and (iii) multi-label MITRE ATT CK tactic, technique, and sub-technique mapping, together with grounded procedure descriptions. By unifying these tasks over evidence grounded in real CTI reports, SMAH-CTI provides a reproducible benchmark for evaluating structured CTI extraction and transforming unstructured reports into machine-interpretable intelligence."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="jaffal-etal-2026-smah">
<titleInfo>
<title>SMAH-CTI: A Unified Sentence-Level Benchmark for Multi-Task Cyber Threat Intelligence Extraction</title>
</titleInfo>
<name type="personal">
<namePart type="given">Niveen</namePart>
<namePart type="given">Omar</namePart>
<namePart type="family">Jaffal</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Radi</namePart>
<namePart type="family">Jarrar</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Mohammed</namePart>
<namePart type="family">Alkhanafseh</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">David</namePart>
<namePart type="family">Mohaisen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Cyber Threat Intelligence (CTI) reports describe adversary behavior and attack infrastructure in natural language but remain largely unstructured and difficult to process at scale. Existing CTI benchmarks are limited in realism or scope, often relying on synthetic or knowledge-base-derived data, coarse document-level annotations, or isolated subtasks. We introduce SMAH-CTI, a human-annotated benchmark derived from 100 public CTI reports from five threat intelligence providers. It contains 12,304 validated sentence-level instances annotated for (i) relevance classification, (ii) CTI-specific named entity recognition (NER), and (iii) multi-label MITRE ATT CK tactic, technique, and sub-technique mapping, together with grounded procedure descriptions. By unifying these tasks over evidence grounded in real CTI reports, SMAH-CTI provides a reproducible benchmark for evaluating structured CTI extraction and transforming unstructured reports into machine-interpretable intelligence.</abstract>
<identifier type="citekey">jaffal-etal-2026-smah</identifier>
<identifier type="doi">10.18653/2026.findings-emnlp.1180</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.1180/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>24937</start>
<end>24955</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T SMAH-CTI: A Unified Sentence-Level Benchmark for Multi-Task Cyber Threat Intelligence Extraction
%A Jaffal, Niveen Omar
%A Jarrar, Radi
%A Alkhanafseh, Mohammed
%A Mohaisen, David
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F jaffal-etal-2026-smah
%X Cyber Threat Intelligence (CTI) reports describe adversary behavior and attack infrastructure in natural language but remain largely unstructured and difficult to process at scale. Existing CTI benchmarks are limited in realism or scope, often relying on synthetic or knowledge-base-derived data, coarse document-level annotations, or isolated subtasks. We introduce SMAH-CTI, a human-annotated benchmark derived from 100 public CTI reports from five threat intelligence providers. It contains 12,304 validated sentence-level instances annotated for (i) relevance classification, (ii) CTI-specific named entity recognition (NER), and (iii) multi-label MITRE ATT CK tactic, technique, and sub-technique mapping, together with grounded procedure descriptions. By unifying these tasks over evidence grounded in real CTI reports, SMAH-CTI provides a reproducible benchmark for evaluating structured CTI extraction and transforming unstructured reports into machine-interpretable intelligence.
%R 10.18653/2026.findings-emnlp.1180
%U https://aclanthology.org/2026.findings-emnlp.1180/
%U https://doi.org/10.18653/2026.findings-emnlp.1180
%P 24937-24955
Markdown (Informal)
[SMAH-CTI: A Unified Sentence-Level Benchmark for Multi-Task Cyber Threat Intelligence Extraction](https://aclanthology.org/2026.findings-emnlp.1180/) (Jaffal et al., Findings 2026)
ACL