  Public and commercial organizations extensively share cyberthreat
intelligence (CTI) to prepare systems to defend against existing and emerging
cyberattacks. However, traditional CTI has primarily focused on tracking known
threat indicators such as IP addresses and domain names, which may not provide
long-term value in defending against evolving attacks. To address this
challenge, we propose to use more robust threat intelligence signals called
attack patterns. LADDER is a knowledge extraction framework that can extract
text-based attack patterns from CTI reports at scale. The framework
characterizes attack patterns by capturing the phases of an attack in Android
and enterprise networks and systematically maps them to the MITRE ATT\&CK
pattern framework. LADDER can be used by security analysts to determine the
presence of attack vectors related to existing and emerging threats, enabling
them to prepare defenses proactively. We also present several use cases to
demonstrate the application of LADDER in real-world scenarios. Finally, we
provide a new, open-access benchmark malware dataset to train future
cyberthreat intelligence models.
