Work

Elevating Cyber Threat Intelligence against disinformation campaigns with LLM-based concept extraction and the FakeCTI dataset

Year: 2025

Type: article

Abstract: The swift spread of fake news and disinformation campaigns poses a significant threat to public trust, political stability, and cybersecurity. Traditional Cyber Threat Intelligence (CTI) approaches, which rely on low-level indicators such as domain names and social media handles, are easily evaded by adversaries who frequently modify their online infrastructure. To address these limitations, we introduce a novel CTI framework that focuses on high-level, semantic indicators derived from recurrent narratives and relationships of disinformation campaigns. Our approach extracts structured CTI indicators from unstructured disinformation content, capturing key entities and their contextual dependencies within fake news using Large Language Models (LLMs). We further introduce FakeCTI, the first dataset that systematically links fake news to disinformation campaigns and threat actors. To evaluate the effectiveness of our CTI framework, we analyze multiple fake news attribution techniques, spanning from traditional Natural Language Processing (NLP) to fine-tuned LLMs. This work shifts the focus from low-level artifacts to persistent conceptual structures, establishing a scalable and adaptive approach to tracking and countering disinformation campaigns.

Source: Journal of Systems and Software

DOI: 10.1016/j.jss.2025.112660

Authors: Domenico Cotroneo, Roberto Natella, Vittorio Orbinato

Institution: University of Naples Federico II

Language: English

Topic: Misinformation and Its Impacts

Subfield: Sociology and Political Science

Field: Social Sciences

Domain: Social Sciences

SDG: Peace, justice, and strong institutions

Open Access status: hybrid

Estimated APC paid: $3,820