Large language model engine analysis and tracking of dark web data and threat actors

Abstract

A method includes obtaining multiple raw dark web posts. The multiple raw dark web posts are preprocessed to obtain a tokenized dark web post set. A prompt is constructed for a threat analyzer large language model (LLM). The prompt includes at least a first tokenized dark web post a set of threat personas, each threat persona including a category and a definition, and an instruction to categorize the first tokenized dark web post with a threat persona and generate a first explanation corresponding to the categorization of the first tokenized dark web post. The prompt is processed by the threat analyzer LLM, to obtain a first annotated post and a corresponding first threat persona category. The first annotated post includes a post summary corresponding to the first tokenized dark web post, and the first explanation. The first explanation is based on a first threat persona definition.