@inproceedings{haughton-etal-2026-privacy,
title = "When Privacy Helps: Pseudonymisation as a Strategy for Improved Cyber Incident Classification",
author = "Haughton, Loya C. and
Fidalgo, Eduardo and
Alaiz-Rodr{\'i}guez, Roc{\'i}o and
Castej{\'o}n-Limas, Manuel and
Fern{\'a}ndez-Robles, Laura",
editor = "Mitkov, Ruslan and
Mu{\~n}oz, Rafael and
Lloret, Elena and
Ranasinghe, Tharindu and
Estevanell-Valladares, Ernesto L. and
Lamsiyah, Salima and
Montoyo, Andr{\'e}s and
Ezzini, Saad",
booktitle = "Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security",
month = jun,
year = "2026",
address = "Alicante, Spain",
publisher = "Department of Languages and Information Systems, University of Alicante",
url = "https://aclanthology.org/2026.nlpaics-1.23/",
pages = "215--227",
abstract = "Organisations often rely on Cyber Threat Intelligence (CTI) for collective defence against evolving threats. Therefore, it is important that these shared reports are both compliant with data protection legislation and analytically useful. Pseudonymisation is a recognised data protection measure, yet its effect on downstream utility remains underexplored in cybersecurity. Unlike other domains where personal identifiers carry predictive value, personal data in cyber incident reports may act as noise rather than signal {---} suggesting pseudonymisation could improve classification accuracy. This hypothesis is evaluated in two steps. First, we derive three new datasets by applying Data Masking, Data Tokenisation and Data Substitution to a subset of the CECILIA-10C-900 dataset. We then evaluate 21 models {---} spanning traditional Machine Learning (ML) classifiers, encoder transformers and QLoRA fine-tuned Large Language Models (LLMs) {---} on these datasets, for a CTI classification task based on the Spanish National Cybersecurity Institute{'}s incident taxonomy. The RoBERTa-base model achieved the highest overall weighted F1-score of 87.35{\%} when Data Tokenisation was applied, while Llama-3.1-8B demonstrated the largest gain (+12.63 pp) with Data Masking. These findings reframe pseudonymisation from only a compliance measure into a preprocessing step that may simultaneously protect privacy and improve classification in specific model-technique pairings."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="haughton-etal-2026-privacy">
<titleInfo>
<title>When Privacy Helps: Pseudonymisation as a Strategy for Improved Cyber Incident Classification</title>
</titleInfo>
<name type="personal">
<namePart type="given">Loya</namePart>
<namePart type="given">C</namePart>
<namePart type="family">Haughton</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Eduardo</namePart>
<namePart type="family">Fidalgo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Rocío</namePart>
<namePart type="family">Alaiz-Rodríguez</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Manuel</namePart>
<namePart type="family">Castejón-Limas</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Laura</namePart>
<namePart type="family">Fernández-Robles</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-06</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security</title>
</titleInfo>
<name type="personal">
<namePart type="given">Ruslan</namePart>
<namePart type="family">Mitkov</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Rafael</namePart>
<namePart type="family">Muñoz</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Elena</namePart>
<namePart type="family">Lloret</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tharindu</namePart>
<namePart type="family">Ranasinghe</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ernesto</namePart>
<namePart type="given">L</namePart>
<namePart type="family">Estevanell-Valladares</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Salima</namePart>
<namePart type="family">Lamsiyah</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Andrés</namePart>
<namePart type="family">Montoyo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Saad</namePart>
<namePart type="family">Ezzini</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Department of Languages and Information Systems, University of Alicante</publisher>
<place>
<placeTerm type="text">Alicante, Spain</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
</relatedItem>
<abstract>Organisations often rely on Cyber Threat Intelligence (CTI) for collective defence against evolving threats. Therefore, it is important that these shared reports are both compliant with data protection legislation and analytically useful. Pseudonymisation is a recognised data protection measure, yet its effect on downstream utility remains underexplored in cybersecurity. Unlike other domains where personal identifiers carry predictive value, personal data in cyber incident reports may act as noise rather than signal — suggesting pseudonymisation could improve classification accuracy. This hypothesis is evaluated in two steps. First, we derive three new datasets by applying Data Masking, Data Tokenisation and Data Substitution to a subset of the CECILIA-10C-900 dataset. We then evaluate 21 models — spanning traditional Machine Learning (ML) classifiers, encoder transformers and QLoRA fine-tuned Large Language Models (LLMs) — on these datasets, for a CTI classification task based on the Spanish National Cybersecurity Institute’s incident taxonomy. The RoBERTa-base model achieved the highest overall weighted F1-score of 87.35% when Data Tokenisation was applied, while Llama-3.1-8B demonstrated the largest gain (+12.63 pp) with Data Masking. These findings reframe pseudonymisation from only a compliance measure into a preprocessing step that may simultaneously protect privacy and improve classification in specific model-technique pairings.</abstract>
<identifier type="citekey">haughton-etal-2026-privacy</identifier>
<location>
<url>https://aclanthology.org/2026.nlpaics-1.23/</url>
</location>
<part>
<date>2026-06</date>
<extent unit="page">
<start>215</start>
<end>227</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T When Privacy Helps: Pseudonymisation as a Strategy for Improved Cyber Incident Classification
%A Haughton, Loya C.
%A Fidalgo, Eduardo
%A Alaiz-Rodríguez, Rocío
%A Castejón-Limas, Manuel
%A Fernández-Robles, Laura
%Y Mitkov, Ruslan
%Y Muñoz, Rafael
%Y Lloret, Elena
%Y Ranasinghe, Tharindu
%Y Estevanell-Valladares, Ernesto L.
%Y Lamsiyah, Salima
%Y Montoyo, Andrés
%Y Ezzini, Saad
%S Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security
%D 2026
%8 June
%I Department of Languages and Information Systems, University of Alicante
%C Alicante, Spain
%F haughton-etal-2026-privacy
%X Organisations often rely on Cyber Threat Intelligence (CTI) for collective defence against evolving threats. Therefore, it is important that these shared reports are both compliant with data protection legislation and analytically useful. Pseudonymisation is a recognised data protection measure, yet its effect on downstream utility remains underexplored in cybersecurity. Unlike other domains where personal identifiers carry predictive value, personal data in cyber incident reports may act as noise rather than signal — suggesting pseudonymisation could improve classification accuracy. This hypothesis is evaluated in two steps. First, we derive three new datasets by applying Data Masking, Data Tokenisation and Data Substitution to a subset of the CECILIA-10C-900 dataset. We then evaluate 21 models — spanning traditional Machine Learning (ML) classifiers, encoder transformers and QLoRA fine-tuned Large Language Models (LLMs) — on these datasets, for a CTI classification task based on the Spanish National Cybersecurity Institute’s incident taxonomy. The RoBERTa-base model achieved the highest overall weighted F1-score of 87.35% when Data Tokenisation was applied, while Llama-3.1-8B demonstrated the largest gain (+12.63 pp) with Data Masking. These findings reframe pseudonymisation from only a compliance measure into a preprocessing step that may simultaneously protect privacy and improve classification in specific model-technique pairings.
%U https://aclanthology.org/2026.nlpaics-1.23/
%P 215-227
Markdown (Informal)
[When Privacy Helps: Pseudonymisation as a Strategy for Improved Cyber Incident Classification](https://aclanthology.org/2026.nlpaics-1.23/) (Haughton et al., NLPAICS 2026)
ACL