results
Findings, models and data from the project, and academic work carried out within it.
The first project results will be published as soon as they are consolidated.
master's theses
- TFMDesign and development of a new tool for detecting Tactics, Techniques and Procedures (TTPs) from threat intelligence reportsMaster's Degree in Cybersecurity, University of Alcalá, 2026
TTPAutoGraph, an open-source Python tool that extracts MITRE ATT&CK TTPs (with TTPXHunter, based on SecureBERT) and indicators of compromise from PDF threat reports and represents them as interactive graphs to compare reports and profile APT groups. Validated against the analyst-annotated CTI-HAL dataset.
- TFMAutomated extraction of Tactics, Techniques and Procedures (TTPs) from threat reports to build a unified dataset for attributionMaster's Degree in Cybersecurity, University of Alcalá, 2026
A reproducible pipeline that processes PDF CTI reports and extracts TTPs and indicators of compromise with TTPXHunter and with a large language model, and incorporates the visual content of the reports through a multimodal model. The result is a unified dataset of 1,673 reports, intended as a basis for attributing attacks to APT groups.
- TFMEvaluation of public cyber threat intelligence datasetsMaster's Degree in Cybersecurity, University of Alcalá, 2026
A framework for measuring the quality of openly shared cyber threat intelligence, applied to almost 20,000 LevelBlue OTX pulses. They are normalised and enriched with MITRE ATT&CK, MISP Galaxy and Malpedia, compared with CIRCL using VirusTotal as reference, and adversary attribution is tested with NMF; source quality conditions attribution quality.
- TFMAnalysis of the ransomware ecosystemMaster's Degree in Cybersecurity, University of Alcalá, 2026
A cyber intelligence analysis of the evolution of ransomware between 2020 and 2026, covering more than 25,000 attacks, 800 vulnerabilities and 3,000 techniques. It shows the shift to double extortion, fragmentation into short-lived groups under the RaaS model, and the growing weight of initial access brokers over vulnerability exploitation.