摘要： 网络威胁情报（CTI）在缓解网络攻防的不对称性方面具有关键作用，但现有战术、技术和程序（TTP）提取方法主要依赖人工标注的全监督语言模型，存在效率低、一致性差的问题。尽管MITRE ATT&CK框架通过标准化分类缓解了TTP描述问题，但当前基于自然语言处理（NLP）的方法仍面临泛化能力不足、版本适配滞后和可解释性差三大挑战。为此，通过融合大语言模型先验知识与外部可信知识，提出了一种基于零样本学习的大模型TTP抽取方法DetecTTive。该方法创新性地利用ATT&CK官方知识库作为外部知识源，融合向量语义知识检索和图增强关联推理，结合智能体工作流实现自动化白盒推理，在提升零样本性能的同时确保结果可追溯。实验表明，该零样本方案在基准数据集上F1达到80.02%，召回率达到83.46%，有效解决了传统模型的数据偏差和版本适配问题，为动态威胁环境下的TTP抽取提供了可解释的低成本解决方案。

Abstract: Cyber Threat Intelligence (CTI) plays a pivotal role in mitigating the asymmetry between cyber attacks and defenses. However, current extraction methods for Tactics, Techniques, and Procedures (TTPs) predominantly rely on supervised language models with manual annotation, which suffer from inefficiency and inconsistency issues. Although the MITRE ATT&CK framework has mitigated TTP description problems through standardized classification, existing NLP-based approaches still face three major challenges: insufficient generalization capabilities, delayed version adaptation, and poor interpretability. To address this, DetecTTive is proposed—a zero-shot learning-based TTP extraction method for large language models that combines the prior knowledge of large language models with external trustworthy knowledge. This framework innovatively utilizes the ATT&CK official knowledge base as an external knowledge source, combining vector-based semantic retrieval and graph-enhanced association reasoning, along with agent workflow to achieve automated white-box reasoning. This enhances zero-shot performance while ensuring result traceability. Experiments demonstrate that the proposed zero-shot approach achieves an F1 score of 80.02% and a recall of 83.46% in benchmark datasets. This method effectively addresses the data bias and version adaptation issues inherent in conventional models, providing an interpretable and cost-efficient solution for TTP extraction in dynamic threat environments.