New framework TTP-R1 enhances cyber threat intelligence analysis

Researchers have developed TTP-R1, a novel two-stage framework designed to improve the extraction of attack techniques from cyber threat intelligence (CTI) text. This framework combines retrieval-augmented supervised fine-tuning with reinforcement learning, using verifiable rewards to directly supervise the precision, recall, and format of predicted technique sets. TTP-R1 significantly outperforms existing methods, achieving a 7.4 percentage point improvement in sub-technique-level F1 score over Claude Sonnet 4.5 with retrieval augmentation, while also operating much faster. AI

IMPACT This research could lead to more efficient and accurate automated analysis of cyber threat intelligence, improving security operations.

RANK_REASON The item is an academic paper detailing a new framework for attack technique extraction from cyber threat intelligence. [lever_c_demoted from research: ic=1 ai=1.0]

Read on arXiv cs.CL →

• alphaXiv
• arXiv
• CatalyzeX
• Claude Sonnet 4.5
• DagsHub
• Gotit.pub
• Hugging Face
• Influence Flower
• Mitre ATT&CK
• ScienceCast
• TTP-R1

• paper
• model release

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →