Multi-Step LLM Pipeline for Enhancing TTP Extraction in Cyber Threat Intelligence
摘要
Tactics, techniques, and procedures (TTPs) are essential for modeling adversary behavior and supporting cyber defense operations. Despite their importance, most cyber threat intelligence (CTI) is provided in unstructured formats, making automated TTP extraction challenging. While manual identification is labor-intensive, current automated approaches suffer from limited accuracy and coverage. To address these challenges, we present a novel multi-step framework based on large language models (LLMs) for extracting MITRE ATT&CK techniques from raw CTI document. Our framework consists of three components: an LLM-basedExtractorfor extracting procedure-level threat actions, an embedding-drivenTechnique Candidate Generatorfor retrieving semantically relevant technique candidates, and aValidatorthat ranks candidate techniques by likelihood using LLM inference to refine final predictions and reduce false positives. Experimental results on the benchmark dataset demonstrate that our approach significantly outperforms existing baselines, achieving an F1-score of 82.28%, thereby validating its effectiveness. Additionally, the modularity of our framework allows seamless integration of future LLMs, suggesting continual performance gains as foundation models evolve.