Large Language Models and Generative Artificial Intelligence
TANG Weilin, WANG Junfeng, GE Wenhan, ZHANG Chengcheng, ZHAN Weilu
Cyber Threat Intelligence (CTI) plays a pivotal role in mitigating the asymmetry in cyberattacks and defense. However, existing methods for extracting Tactics, Techniques, and Procedures (TTP) primarily rely on manually annotated fully supervised language models, which suffer from low efficiency and poor consistency. Although the MITRE ATT&CK framework alleviates the problem of TTP description through standardized classification, current Natural Language Processing (NLP)-based methods still face three major challenges: insufficient generalization ability, lagging version adaptation, and poor interpretability. To address this, a zero-shot learning-based TTP extraction method for large models, called DetecTTive, that integrates the prior knowledge of a Large Language Model (LLM) with external trusted knowledge is proposed. This method utilizes the official ATT&CK knowledge base as an external knowledge source, combines vector semantic knowledge retrieval and graph-enhanced associative reasoning, and implements automated white-box reasoning through an agent workflow, ensuring the traceability of results while enhancing zero-shot performance. The experimental results show that the proposed method achieves an F1 value of 80.02% and a recall rate of 83.46% on the benchmark dataset, effectively addressing data bias and version adaptation issues in traditional models. This method provides an interpretable and low-cost solution for TTP extraction in dynamic threat environments.