Abstract: Cyber Threat Intelligence (CTI) plays a pivotal role in mitigating the asymmetry in cyberattacks and defense. However, existing methods for extracting Tactics, Techniques, and Procedures (TTP) primarily rely on manually annotated fully supervised language models, which suffer from low efficiency and poor consistency. Although the MITRE ATT&CK framework alleviates the problem of TTP description through standardized classification, current Natural Language Processing (NLP)-based methods still face three major challenges: insufficient generalization ability, lagging version adaptation, and poor interpretability. To address this, a zero-shot learning-based TTP extraction method for large models, called DetecTTive, that integrates the prior knowledge of a Large Language Model (LLM) with external trusted knowledge is proposed. This method utilizes the official ATT&CK knowledge base as an external knowledge source, combines vector semantic knowledge retrieval and graph-enhanced associative reasoning, and implements automated white-box reasoning through an agent workflow, ensuring the traceability of results while enhancing zero-shot performance. The experimental results show that the proposed method achieves an F1 value of 80.02% and a recall rate of 83.46% on the benchmark dataset, effectively addressing data bias and version adaptation issues in traditional models. This method provides an interpretable and low-cost solution for TTP extraction in dynamic threat environments.

Key words: Large Language Model (LLM), Cyber Threat Intelligence（CTI）, Tactics, Techniques, and Procedures（TTP）, zero-shot, agent

摘要： 网络威胁情报（CTI）在缓解网络攻防的不对称性方面具有关键作用，但现有战术、技术和程序（TTP）提取方法主要依赖人工标注的全监督语言模型，存在效率低、一致性差的问题。尽管MITRE ATT&CK框架通过标准化分类缓解了TTP描述问题，但当前基于自然语言处理（NLP）的方法仍面临泛化能力不足、版本适配滞后和可解释性差三大挑战。为此，通过融合大语言模型（LLM）的先验知识与外部可信知识，提出一种基于零样本学习的大模型TTP抽取方法DetecTTive。该方法利用ATT&CK官方知识库作为外部知识源，融合向量语义知识检索和图增强关联推理，结合智能体工作流实现自动化白盒推理，在提升零样本性能的同时确保结果可追溯。实验结果表明，该方法在基准数据集上的F1值达到80.02%，召回率达到83.46%，有效解决了传统模型的数据偏差和版本适配问题，为动态威胁环境下的TTP抽取提供了可解释、低成本的解决方案。

关键词: 大语言模型, 网络威胁情报, 战术、技术和程序, 零样本, 智能体

CLC Number: 

• TP18