# Towards Automated Classification of Attackers' TTPs by combining NLP with ML Techniques

arXiv: https://arxiv.org/abs/2207.08478 · HTML: https://mlsanity.com/paper/2207.08478/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 54 references that are in the map.
- First posted on arXiv 18 Jul 2022.

## Builds on (most cited first, 5 of 5)

- [Spectre Attacks: Exploiting Speculative Execution](https://mlsanity.com/paper/1801.01203/) (2018)
- [Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports](https://mlsanity.com/paper/2004.14322/) (2020)
- [Towards a relation extraction framework for cyber-security concepts](https://mlsanity.com/paper/1504.04317/) (2015)
- [Darknet and Deepnet Mining for Proactive Cybersecurity Threat Intelligence](https://mlsanity.com/paper/1607.08583/) (2016)
- [Mining Threat Intelligence about Open-Source Projects and Libraries from Code Repository Issues and Bug Reports](https://mlsanity.com/paper/1808.04673/) (2018)

## Built on by (most cited first, 5 of 5)

- [On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptions](https://mlsanity.com/paper/2306.14062/) (2023)
- [Advancing TTP Analysis: Harnessing the Power of Large Language Models with Retrieval Augmented Generation](https://mlsanity.com/paper/2401.00280/) (2023)
- [Feature Engineering-Based Detection of Buffer Overflow Vulnerability in Source Code Using Neural Networks](https://mlsanity.com/paper/2306.07981/) (2023)
- [Cyber-Attack Technique Classification Using Two-Stage Trained Large Language Models](https://mlsanity.com/paper/2411.18755/) (2024)
- [Operationalizing Cyber Threat Intelligence with GraphRAG](https://mlsanity.com/paper/2608.13050/) (2026)

## Abstract (arXiv)

The increasingly sophisticated and growing number of threat actors along with the sheer speed at which cyber attacks unfold, make timely identification of attacks imperative to an organisations' security. Consequently, persons responsible for security employ a large variety of information sources concerning emerging attacks, attackers' course of actions or indicators of compromise. However, a vast amount of the needed security information is available in unstructured textual form, which complicates the automated and timely extraction of attackers' Tactics, Techniques and Procedures (TTPs). In order to address this problem we systematically evaluate and compare different Natural Language Processing (NLP) and machine learning techniques used for security information extraction in research. Based on our investigations we propose a data processing pipeline that automatically classifies unstructured text according to attackers' tactics and techniques derived from a knowledge base of adversary tactics, techniques and procedures.