Automated Relationship Extraction for Cyber-Attack Attribution: Relation-Annotated Dataset and Fine-Tuned Model

This dataset provides a supervised relation-extraction layer over the AttackER cyber-threat-intelligence corpus for the task of cyber-attack attribution. It comprises entity pairs labelled with one of nine STIX-aligned relation types (uses, targets, affects, causes, motivated-by, indicates, communicates-with, attributed-to, located-at) plus a no_relation class. Training and development labels were generated using a large language model (GPT-4o) as a silver annotator; the test set was annotated manually to serve as a gold-standard benchmark. The dataset accompanies an MSc dissertation at the University of Southampton and is released together with a fine-tuned CySecBERT relation-extraction model. Labels are provided as directed triples (source entity, relation, target entity) suitable for knowledge-graph construction. Note: relation labels are derived from the AttackER corpus; users should consult and comply with the original AttackER dataset licence for the underlying text.