David Mohaisen

Author directory

2026

Cyber Threat Intelligence (CTI) reports describe adversary behavior and attack infrastructure in natural language but remain largely unstructured and difficult to process at scale. Existing CTI benchmarks are limited in realism or scope, often relying on synthetic or knowledge-base-derived data, coarse document-level annotations, or isolated subtasks. We introduce SMAH-CTI, a human-annotated benchmark derived from 100 public CTI reports from five threat intelligence providers. It contains 12,304 validated sentence-level instances annotated for (i) relevance classification, (ii) CTI-specific named entity recognition (NER), and (iii) multi-label MITRE ATT CK tactic, technique, and sub-technique mapping, together with grounded procedure descriptions. By unifying these tasks over evidence grounded in real CTI reports, SMAH-CTI provides a reproducible benchmark for evaluating structured CTI extraction and transforming unstructured reports into machine-interpretable intelligence.