# On Technique Identification and Threat-Actor Attribution using LLMs and Embedding Models

arXiv: https://arxiv.org/abs/2505.11547 · HTML: https://mlsanity.com/paper/2505.11547/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 34 references that are in the map.
- First posted on arXiv 15 May 2025.

## Builds on (most cited first, 11 of 11)

- [MTEB: Massive Text Embedding Benchmark](https://mlsanity.com/paper/2210.07316/) (2022)
- [Precise Zero-Shot Dense Retrieval without Relevance Labels](https://mlsanity.com/paper/2212.10496/) (2022)
- [A Survey on Large Language Models with some Insights on their Capabilities and Limitations](https://mlsanity.com/paper/2501.04040/) (2025)
- [Misleading Authorship Attribution of Source Code using Adversarial Learning](https://mlsanity.com/paper/1905.12386/) (2019)
- [Automated Behavioral Analysis of Malware A Case Study of WannaCry Ransomware](https://mlsanity.com/paper/1709.08753/) (2017)
- [DeepSign: Deep Learning for Automatic Malware Signature Generation and Classification](https://mlsanity.com/paper/1711.08336/) (2017)
- [DeepAPT: Nation-State APT Attribution Using End-to-End Deep Neural Networks](https://mlsanity.com/paper/1711.09666/) (2017)
- [A Comprehensive Survey of Advanced Persistent Threat Attribution: Taxonomy, Methods, Challenges and Open Research Problems](https://mlsanity.com/paper/2409.11415/) (2024)
- [Identifying Authorship Style in Malicious Binaries: Techniques, Challenges & Datasets](https://mlsanity.com/paper/2101.06124/) (2021)
- [On the Feasibility of Malware Authorship Attribution](https://mlsanity.com/paper/1701.02711/) (2017)
- [A Machine Learning based Empirical Evaluation of Cyber Threat Actors High Level Attack Patterns over Low level Attack Patterns in Attributing Attacks](https://mlsanity.com/paper/2307.10252/) (2023)

## Built on by (most cited first, 2 of 2)

- [AURA: A Multi-Agent Intelligence Framework for Knowledge-Enhanced Cyber Threat Attribution](https://mlsanity.com/paper/2506.10175/) (2025)
- [Identifying Adversary Tactics and Techniques in Malware Binaries with an LLM Agent](https://mlsanity.com/paper/2602.06325/) (2026)

## Abstract (arXiv)

Attribution of cyber-attacks remains a complex but critical challenge for cyber defenders. Currently, manual extraction of behavioral indicators from dense forensic documentation causes significant attribution delays, especially following major incidents at the international scale. This research evaluates large language models (LLMs) for cyber-attack attribution based on behavioral indicators extracted from forensic documentation. We test OpenAI's GPT-4 and text-embedding-3-large for identifying threat actors' tactics, techniques, and procedures (TTPs) by comparing LLM-generated TTPs against human-generated data from MITRE ATT&CK Groups. Our framework then identifies TTPs from text using vector embedding search and builds profiles to attribute new attacks for a machine learning model to learn. Key contributions include: (1) assessing off-the-shelf LLMs for TTP extraction and attribution, and (2) developing an end-to-end pipeline from raw CTI documents to threat-actor prediction. This research finds that standard LLMs generate TTP datasets with noise, resulting in a low similarity to human-generated datasets. However, the TTPs generated are similar in frequency to those within the existing MITRE datasets. Additionally, although these TTPs are different than human-generated datasets, our work demonstrates that they still prove useful for training a model that performs above baseline on attribution. Project code and files are contained here: https://github.com/kylag/ttp_attribution.