CTI Dataset Construction from Telegram
This work addresses the need for timely and diverse CTI datasets to support cyber threat detection, though it is incremental as it applies existing methods to a new data source.
The authors tackled the problem of constructing a high-quality Cyber Threat Intelligence (CTI) dataset by developing an automated pipeline to collect and filter threat-related content from Telegram, resulting in a dataset of 86,509 malicious Indicators of Compromise with a BERT-based classifier achieving 96.64% accuracy.
Cyber Threat Intelligence (CTI) enables organizations to anticipate, detect, and mitigate evolving cyber threats. Its effectiveness depends on high-quality datasets, which support model development, training, evaluation, and benchmarking. Building such datasets is crucial, as attack vectors and adversary tactics continually evolve. Recently, Telegram has gained prominence as a valuable CTI source, offering timely and diverse threat-related information that can help address these challenges. In this work, we address these challenges by presenting an end-to-end automated pipeline that systematically collects and filters threat-related content from Telegram. The pipeline identifies relevant Telegram channels and scrapes 145,349 messages from 12 curated channels out of 150 identified sources. To accurately filter threat intelligence messages from generic content, we employ a BERT-based classifier, achieving an accuracy of 96.64%. From the filtered messages, we compile a dataset of 86,509 malicious Indicators of Compromise, including domains, IPs, URLs, hashes, and CVEs. This approach not only produces a large-scale, high-fidelity CTI dataset but also establishes a foundation for future research and operational applications in cyber threat detection.