arXiv:2605.03158 · v2
HackerSignal: A Multi-Source, CVE-Linked Corpus and Prospective Benchmark for Cyber Threat Intelligence
摘要
Cyber threat intelligence (CTI) systems must link exploit code, advisories, and fix commits to the vulnerabilities they concern, and they must do so for vulnerabilities disclosed after training. HackerSignal is a public corpus and benchmark built for this prospective setting. It aggregates 7.45 million exact-deduplicated documents from 64 public sources across eight source layers (hacker forums, exploit archives, exploit question-and-answer sites, vulnerability references, advisories, bug-bounty disclosures, fix commits, and known-exploited-vulnerability records), spanning 1988--2026. All layers are keyed to a shared CVE identifier space with source provenance and release-mode governance. We define three benchmark tasks with temporal splits: (1) CVE linkage retrieval over 340,536 National Vulnerability Database descriptions, (2) exploit type classification into eight classes, and (3) temporal generalization, where training and test CVE sets do not overlap ($C_{\rm train} \cap C_{\rm test} = \emptyset$). Zero-shot dense and hybrid retrievers reach a mean reciprocal rank (MRR) of 0.71 on Task 1, and the top models are statistically tied under paired bootstrap tests. Cybersecurity-pretrained encoders lead exploit type classification (macro-F1 0.90). A two-annotator audit of 240 linkage labels finds 79.5% precision (Cohen's \k{appa} 0.94), with per-source precision from 20% to 100%. The hacker-community layer contributes 6.97 million posts but only about 2,000 CVE-linked records. A masked forum-post grounding pilot over these records reaches MRR 0.08, about nine times lower than the structured-source tasks. Grounding informal hacker discourse to vulnerabilities therefore remains an open problem that the release is designed to support. Code, data, and Croissant metadata are available at https://huggingface.co/datasets/BenAmpel/HackerSignal and https://github.com/BenAmpel/hackersignal.
作者备注：Published at NeurIPS 2026 (40th Conference on Neural Information Processing Systems), Track on Evaluations and Datasets. Camera-ready version. 19 pages, 4 figures, 13 tables. Data: https://huggingface.co/datasets/BenAmpel/HackerSignal; code: https://github.com/BenAmpel/hackersignal