Multi-Step LLM Pipeline for Enhancing TTP Extraction in Cyber Threat Intelligence

초록

Tactics, techniques, and procedures (TTPs) are essential for modeling adversary behavior and supporting cyber defense operations. Despite their importance, most cyber threat intelligence (CTI) is provided in unstructured formats, making automated TTP extraction challenging. While manual identification is labor-intensive, current automated approaches suffer from limited accuracy and coverage. To address these challenges, we present a novel multi-step framework based on large language models (LLMs) for extracting MITRE ATT&CK techniques from raw CTI document. Our framework consists of three components: an LLM-based Extractor for extracting procedure-level threat actions, an embedding-driven Technique Candidate Generator for retrieving semantically relevant technique candidates, and a Validator that ranks candidate techniques by likelihood using LLM inference to refine final predictions and reduce false positives. Experimental results on the benchmark dataset demonstrate that our approach significantly outperforms existing baselines, achieving an F1-score of 82.28%, thereby validating its effectiveness. Additionally, the modularity of our framework allows seamless integration of future LLMs, suggesting continual performance gains as foundation models evolve.

키워드