Cyber-Threat Intelligence Attribution on LLM-CTI Attribution
89.2Threat Actor Linking AccuracyG5
Evaluation Results
| Method | Links | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| G5Model Category=Industry-leading, general-purpose2025.09 | 89.2 | 75.1 | 71.2 | 67.7 | 59.8 | 67.9 | 36.2 | 64.2 | |
| Go4Model Category=Industry-leading, general-purpose2025.09 | 87.1 | 73.8 | 69.1 | 65.6 | 58.1 | 52.6 | 24.7 | 62.8 | |
| GEMModel Category=Industry-leading, general-purpose2025.09 | 82.2 | 70.3 | 64.9 | 60.9 | 53.9 | 48.6 | 22.6 | 59.5 | |
| MIXModel Category=Industry-leading, general-purpose2025.09 | 77.3 | 66.9 | 60.7 | 57.4 | 50.3 | 45.9 | 28.8 | 56.2 | |
| SPTModel Category=Cybersecurity-specialized2025.09 | 77.1 | 72.6 | 69.4 | 75.4 | 63.3 | 57.6 | 19.7 | 67.3 | |
| QWNModel Category=Industry-leading, general-purpose2025.09 | 75.3 | 65.4 | 58.6 | 55.6 | 48.8 | 54.7 | 17.8 | 54.7 | |
| CBSModel Category=Cybersecurity-specialized2025.09 | 70.7 | 73.1 | 69.9 | 69.2 | 63.8 | 46.2 | 10.2 | 67.8 | |
| ZYSModel Category=Cybersecurity-specialized2025.09 | 70.4 | 72.4 | 69.4 | 68.8 | 63.2 | 57.4 | 9.7 | 67.5 | |
| CLDModel Category=Industry-leading, general-purpose2025.09 | 65.2 | 72.4 | 67.1 | 63.6 | 56.1 | 50.1 | 13.1 | 61.1 | |
| FSCModel Category=Cybersecurity-specialized2025.09 | 64.3 | 65.4 | 57.8 | 54.8 | 48.9 | 44.4 | 7.3 | 54.4 | |
| DHTModel Category=Cybersecurity-specialized2025.09 | 60.8 | 73.2 | 70.1 | 60.3 | 63.9 | 58.2 | 8.3 | 67.9 | |
| LL70Model Category=Industry-leading, general-purpose2025.09 | 59.8 | 47.8 | 63.1 | 59.1 | 52.1 | 67.2 | 40.2 | 57.9 | |
| GRKModel Category=Industry-leading, general-purpose2025.09 | 52.8 | 64.2 | 56.7 | 53.4 | 47.5 | 43.6 | 20.7 | 53.3 | |
| CB0Model Category=Cybersecurity-specialized2025.09 | 52.6 | 63.9 | 56.3 | 53.1 | 47.6 | 43.1 | 5.9 | 52.8 | |
| LLYModel Category=Cybersecurity-specialized2025.09 | 41.3 | 53.7 | 70.3 | 52.8 | 64.3 | 28.6 | 0.7 | 68.3 |