Algorithmic De-Anonymization in Open Cyber Threat Intelligence Graphs

This paper presents the first systematic empirical evaluation of algorithmic de-anonymization attacks against open cyber threat intelligence (CTI) graphs. Cyber threat intelligence sharing platforms such as MISP and OpenCTI routinely publish graph-structured data after applying anonymization procedures including identifier permutation and attribute redaction. This work demonstrates that graph topology alone — degree sequences, neighborhood structure, and clustering patterns — is sufficient to re-identify entities with high confidence, even when all string identifiers have been removed.