LLM-guided contrastive evidence mining for explainable cyber threat intelligence classification.

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Machine Learning

Background:

• Translating unstructured cyber threat intelligence (CTI) into the MITRE ATT&CK framework is a complex task for security operations.
• Existing automated methods struggle with accuracy, explanation faithfulness, and coverage of infrequent attack techniques.

Purpose of the Study:

• To present CSEM-CTI, a contextual self-adversarial evidence-mining framework designed to enhance the automated classification of cyber threats.
• To improve the accuracy, explanation faithfulness, and robustness of mapping CTI to MITRE ATT&CK tactics and techniques.

Main Methods:

• Developed CSEM-CTI, integrating a domain-adapted SecureBERT encoder and LLM-guided prototype initialization (GPT-4o).
• Employed a contrastive InfoNCE-based necessity loss and a hierarchical tactic-conditioned focal classifier.
• Evaluated the framework on three CTI corpora.

Main Results:

• Achieved a tactic macro-F1 of 0.939 and a technique macro-F1 of 0.481.
• Significantly improved rare-class macro-F1 from 0.083 to 0.363.
• Demonstrated high ERASER comprehensiveness (0.847) and sufficiency (0.923), with a low TextFooler attack success rate (5.5%).

Conclusions:

• Representation quality, prototype geometry, and necessity loss are critical coupled architectural choices for TTP classification.
• CSEM-CTI supports the deployment of auditable tactics, techniques, and procedures (TTP) classification in security workflows.
• The framework offers a robust solution for the automated analysis of cyber threat intelligence.