Elevating Cyber Threat Intelligence against Disinformation Campaigns with LLM-based Concept Extraction and the FakeCTI Dataset

TL;DR

This work addresses the shortcomings of traditional CTI, which relies on mutable low-level indicators, by proposing concept-based CTI indicators extracted from fake news narratives. A structured <subject, relation, object> tuple representation is derived from unstructured articles using LLMs, enabling persistent attribution to campaigns and threat actors. The FakeCTI dataset, comprising 12,155 articles across 43 campaigns and 73 actors, provides a benchmark linking fake news to disinformation operations and dissemination channels. Experimental results show that fine-tuned LLMs (DistilBERT) achieve up to 94% attribution accuracy, outperforming lexical and semantic baselines, demonstrating the framework's robustness to paraphrasing and content variation and its potential for scalable, real-time disinformation tracking.

Abstract

The swift spread of fake news and disinformation campaigns poses a significant threat to public trust, political stability, and cybersecurity. Traditional Cyber Threat Intelligence (CTI) approaches, which rely on low-level indicators such as domain names and social media handles, are easily evaded by adversaries who frequently modify their online infrastructure. To address these limitations, we introduce a novel CTI framework that focuses on high-level, semantic indicators derived from recurrent narratives and relationships of disinformation campaigns. Our approach extracts structured CTI indicators from unstructured disinformation content, capturing key entities and their contextual dependencies within fake news using Large Language Models (LLMs). We further introduce FakeCTI, the first dataset that systematically links fake news to disinformation campaigns and threat actors. To evaluate the effectiveness of our CTI framework, we analyze multiple fake news attribution techniques, spanning from traditional Natural Language Processing (NLP) to fine-tuned LLMs. This work shifts the focus from low-level artifacts to persistent conceptual structures, establishing a scalable and adaptive approach to tracking and countering disinformation campaigns.

Figures (9)

• Figure 1: Traditional and disinformation-oriented Pyramids of Pain.
• Figure 2: Overview of the proposal.
• Figure 3: Example of graph extracted from a fake news article.
• Figure 4: Reachability of disinformation campaigns.
• Figure 5: Overview of the experimental analysis.