Design of an on-premise and actionable cyber threat intelligence model based on X (Twitter) data using large language models (LLMs)

Currently, cyber threat intelligence (CTI) sharing is mostly limited to isolated data points, such as a single IP address or a file hash, which are disconnected from the full context of the threat. This fragmentation makes it difficult for defense teams to determine accurate prioritization. Although the X (Twitter) platform offers much richer and more detailed information about emerging threats, the sheer volume, noise, and unstructured nature of this data prevent it from being processed through traditional analytical methods. This thesis aims to design an end-to-end autonomous CTI model that utilizes X (Twitter) data, strictly maintains data sovereignty by operating locally (on-premise), and produces actionable intelligence. The developed Python-based autonomous system features a comprehensive architecture that includes dynamic data collection via Selenium, semantic analysis using the LLaMA 3 model running locally through the Ollama platform, and structured storage within an SQLite database. The most original engineering contribution of this research is the development of a "JSON Hardening Protocol," which autonomously corrects the erroneous JSON outputs resulting from the stochastic and unpredictable nature of Large Language Models (LLMs). Experimental findings demonstrate that the system analyzed threats from 62 unstructured tweet texts with an accuracy rate of up to 95%, successfully classifying 64,5% of the detected events into the "High Risk" category. During the evaluations, "Vulnerability" (13 instances) and "Threat_Actor" (13 instances) emerged as the most frequently detected threat categories, while the system extracted critical intelligence indicators—such as CVE IDs and Threat Actor Groups—with high precision. Ultimately, this study proves the operational feasibility of an engineering-resilient and fully autonomous CTI solution that completely eliminates the risk of exposing security-critical data to third-party servers.