P-TIMA: a framework of T witter threat intelligence mining and analysis based on a prompt-learning NER model.

The article focuses on P-TIMA, a novel framework for mining and analyzing cyber threat intelligence from Twitter using a prompt learning-based few-shot Named Entity Recognition (NER) method called SecEntPrompt (SEP). SEP transforms entity recognition into a masked word prediction task with semantic label word enrichment, enabling accurate extraction of vulnerability-related entities with limited annotated data. Evaluations demonstrate that SEP improves F1 scores by 3.62–4.40 points over baseline models and outperforms a large language model (LLM) in both recognition accuracy and inference speed. Case studies applying P-TIMA to over 760,000 vulnerability-related tweets reveal insights into emerging vulnerability trends and the exploitation behaviors of Advanced Persistent Threat (APT) groups, supporting defenders in timely threat detection, risk assessment, and forensic attribution. The framework highlights the value of open-source intelligence from social media for proactive cybersecurity defense and outlines future work to integrate LLMs for enhanced threat intelligence mining.