<![CDATA[Open-source threat intelligence platforms provide vast amounts of Indicator of Compromise (IoC) data, but they are frequently saturated with benign operational noise and false alarms, causing severe alert fatigue in Security Operations Centres (SOCs). To mitigate this operational bottleneck, this study presents a comprehensive comparative analysis of automated IoC classification pipelines, evaluating traditional machine learning baselines against Transformer-based architectures. A dataset of 10,000 weakly labelled IoC records was utilised to compare Logistic Regression, Random Forest, and XGBoost (utilising TF-IDF n-grams) with DistilBERT and BERT-Base under two distinct scenarios: Zero-Shot Classification and Supervised Fine-Tuning. Empirical results revealed that while traditional tree-based models like Random Forest achieved a high raw accuracy of 93.78%, general-purpose Transformers in a Zero-Shot setting suffered from catastrophic predictive biases and failed entirely to filter false alarms. However, the application of Supervised Fine-Tuning completely rectified these limitations. The fine-tuned BERT-Base achieved a superior Weighted F1-Score of 92.74%, demonstrating exceptional proficiency in handling the severe class imbalance. Furthermore, an ablation study confirmed that the fine-tuned embeddings successfully learned the underlying syntactic structures of malicious indicators without relying on metadata shortcut learning. Finally, computational scalability tests proved that the lightweight DistilBERT architecture offers the most optimal balance between predictive accuracy and processing latency, rendering it highly viable for integration into batch-processing workflows in real-world SOC environments.]]>
Copyrights © 2026
