Inferring Causality Between Entities and Events from CTI Reports

Inferring causal relationships between entities and events is essential for accelerating root cause analysis in cybersecurity incidents. This capability is particularly critical in cyber threat intelligence, where identifying which entities trigger events and which are affected enables rapid and effective responses. However, most existing causal inference research primarily focuses on event-to-event causality, overlooking the relationships between entities and individual events. To bridge this gap, we constructed a specialized dataset designed to analyze causal relationships between entities and cyber threat events. We then proposed a causal inference model based on a BERT-based multi-layer stacked architecture (MLSA) and trained it using the constructed dataset. To assess its effectiveness, we compared its performance with that of large language models (LLMs) for causal inference. Experimental results demonstrate that the proposed MLSA model outperforms the state-of-the-art GPT-4o, achieving an average F1-score improvement of approximately 38%. Additionally, MLSA achieves a competitive F1-score in causal inference compared to GPT o3-mini while delivering an 11% improvement in effect relation inference. These findings highlight the effectiveness of our approach, introducing a novel and robust model for event-entity causality analysis in cyber threat intelligence.