Cyber Threat Intelligence Analytics For Law Enforcement And National Security

Abstract

Cyber threat intelligence (CTI) is an important part of law enforcement and national security operations today; however, current processing of threat reports far exceeds the ability to manually triage them. We introduce an explainable, multi-task analytics framework that jointly models three operationally relevant tasks on CTI reports: threat categorization, severity estimation and threat-actor attribution. It mixes a rough setup by utilizing a transformer-backed content encoder on sanitized danger depictions alongside an organized branch structured based on hand-built indicator-of-compromise (IOC) quantities, assault vector's geographic location, and the forum-sentiment indicators. We benchmark four model families (logistic regression, random forest, gradient boosting [XGBoost], and a fused deep neural network) under a leakage-free protocol that integrates stratified five-fold cross-validation with an independent held-out test set. We validate that the observed performance is a legitimate signal, not artefacts, by performing label-permutation testing and analyzing feature-target associations. Threat categorization achieves 93.3 percent accuracy (macro F1 0.933, Cohen kappa 0.911) on the held-out test set, while severity estimation and actor attribution achieve up to 52.1 percent and 50.3 percent accuracy, respectively, which are both statistically significant above chance (permutation p less than 0.01). Model explanation: An ablation study isolates the contribution of each modality, and SHAP, Integrated Gradients and a local surrogate explainer uncover the tokens and indicators driving predictions. We transparently report performance, highlighting those tasks with modest accuracy, and discuss implications for operations and methods when deploying CTI analytics in security-sensitive contexts.