Cyber Threat Intelligence for Hybrid Attacks: Leveraging LLMs and Data Spaces

Cyberattacks have emerged as a critical component of modern hybrid warfare. To effectively counter these hybrid threats, societies require rapid detection and response capabilities. Cyber Threat Intelligence (CTI) provides means to capture ongoing attacks but suffers from the quality and massive volume of data. Furthermore, state-sponsored cyberattacks often evade detection and are challenging to attribute to the perpetrator due to their sophisticated techniques and technical obfuscation. To address these challenges systematically, we propose a framework of generic metrics for identifying typical features of hybrid operations from CTI. Additionally, we propose proof-of-concepts for scalable and automated measuring, prioritization, and sharing of CTI. Our implementations leverage Large Language Models (LLMs), Gaia-X data sharing architecture, as well as MITRE attack matrices and Cyber Operations Tracker as data sources.