AnnoCTR consists of 400 cyber threat reports that have been obtained from commercial CTI vendors. The reports describe threat-related information such as tactics, techniques, actors, tools, and targeted industries. The reports have been annotated by a domain expert with named entities, temporal expressions, and cybersecurity-specific concepts. The annotations include mentions of organizations, locations, industry sectors, time expressions, code snippets, hacker groups, malware, tools, tactics, and techniques.
The dataset is split into three parts: train, dev, and test, with 60%, 15%, and 25% of the documents, respectively. The train set is used for model training, the dev set is used for model selection, and the test set is used for evaluation.
For further information on the annotation scheme, please refer to our paper and the annotation guidelines for the general concepts and cybersecurity-specific concepts.
