# Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports

arXiv: https://arxiv.org/abs/2004.14322 · HTML: https://mlsanity.com/paper/2004.14322/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Apr 2020.

## Built on by (most cited first, 17 of 17)

- [Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild](https://mlsanity.com/paper/2307.10214/) (2023)
- [TechniqueRAG: Retrieval Augmented Generation for Adversarial Technique Annotation in Cyber Threat Intelligence Text](https://mlsanity.com/paper/2505.11988/) (2025)
- [Towards Automated Classification of Attackers' TTPs by combining NLP with ML Techniques](https://mlsanity.com/paper/2207.08478/) (2022)
- [Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognition](https://mlsanity.com/paper/2401.10337/) (2024)
- [Mining Temporal Attack Patterns from Cyberthreat Intelligence Reports](https://mlsanity.com/paper/2401.01883/) (2024)
- [AnnoCTR: A Dataset for Detecting and Linking Entities, Tactics, and Techniques in Cyber Threat Reports](https://mlsanity.com/paper/2404.07765/) (2024)
- [MITRE ATT&CK Applications in Cybersecurity and The Way Forward](https://mlsanity.com/paper/2502.10825/) (2025)
- [Towards a scalable AI-driven framework for data-independent Cyber Threat Intelligence Information Extraction](https://mlsanity.com/paper/2501.06239/) (2025)
- [Constructing Multi-label Hierarchical Classification Models for MITRE ATT&CK Text Tagging](https://mlsanity.com/paper/2601.14556/) (2026)
- [Evaluating Open-Source LLMs for Multi-Label ATT&CK Technique Classification on CTI Reports](https://mlsanity.com/paper/2606.18166/) (2026)
- [Automated Mapping of CVE Vulnerability Records to MITRE CWE Weaknesses](https://mlsanity.com/paper/2304.11130/) (2023)
- [Cyber-Attack Technique Classification Using Two-Stage Trained Large Language Models](https://mlsanity.com/paper/2411.18755/) (2024)
- [Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluation](https://mlsanity.com/paper/2606.18190/) (2026)
- [An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports](https://mlsanity.com/paper/2607.19742/) (2026)
- [ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping](https://mlsanity.com/paper/2607.27528/) (2026)
- [BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligence](https://mlsanity.com/paper/2608.28394/) (2026)
- [A TTP by TTP Approach: Precise Malware Detection via Malicious TTP Recognition](https://mlsanity.com/paper/2609.06579/) (2026)

## Abstract (arXiv)

Over the last years, threat intelligence sharing has steadily grown, leading cybersecurity professionals to access increasingly larger amounts of heterogeneous data. Among those, cyber attacks' Tactics, Techniques and Procedures (TTPs) have proven to be particularly valuable to characterize threat actors' behaviors and, thus, improve defensive countermeasures. Unfortunately, this information is often hidden within human-readable textual reports and must be extracted manually. In this paper, we evaluate several classification approaches to automatically retrieve TTPs from unstructured text. To implement these approaches, we take advantage of the MITRE ATT&CK framework, an open knowledge base of adversarial tactics and techniques, to train classifiers and label results. Finally, we present rcATT, a tool built on top of our findings and freely distributed to the security community to support cyber threat report automated analysis.