# Constructing Multi-label Hierarchical Classification Models for MITRE ATT&CK Text Tagging

arXiv: https://arxiv.org/abs/2601.14556 · HTML: https://mlsanity.com/paper/2601.14556/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 33 references that are in the map.
- First posted on arXiv 21 Jan 2026.

## Builds on (most cited first, 12 of 12)

- [CTIBench: A Benchmark for Evaluating LLMs in Cyber Threat Intelligence](https://mlsanity.com/paper/2406.07599/) (2024)
- [AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports](https://mlsanity.com/paper/2111.07093/) (2021)
- [Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI](https://mlsanity.com/paper/2211.01753/) (2022)
- [EXTRACTOR: Extracting Attack Behavior from Threat Reports](https://mlsanity.com/paper/2104.08618/) (2021)
- [LLMCloudHunter: Harnessing LLMs for Automated Extraction of Detection Rules from Cloud-Based CTI](https://mlsanity.com/paper/2407.05194/) (2024)
- [Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports](https://mlsanity.com/paper/2004.14322/) (2020)
- [Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approach](https://mlsanity.com/paper/2108.01696/) (2021)
- [Advancing TTP Analysis: Harnessing the Power of Large Language Models with Retrieval Augmented Generation](https://mlsanity.com/paper/2401.00280/) (2023)
- [TTPXHunter: Actionable Threat Intelligence Extraction as TTPs from Finished Cyber Threat Reports](https://mlsanity.com/paper/2403.03267/) (2024)
- [CyLens: Towards Reinventing Cyber Threat Intelligence in the Paradigm of Agentic Large Language Models](https://mlsanity.com/paper/2502.20791/) (2025)
- [CTI-HAL: A Human-Annotated Dataset for Cyber Threat Intelligence Analysis](https://mlsanity.com/paper/2504.05866/) (2025)
- [Auspex: Building Threat Modeling Tradecraft into an Artificial Intelligence-based Copilot](https://mlsanity.com/paper/2503.09586/) (2025)

## Built on by (most cited first, 1 of 1)

- [Retrieval-Constrained Policy Optimization for Attack Technique Extraction from Cyber Threat Intelligence](https://mlsanity.com/paper/2608.06778/) (2026)

## Abstract (arXiv)

MITRE ATT&CK is a cybersecurity knowledge base that organizes threat actor and cyber-attack information into a set of tactics describing the reasons and goals threat actors have for carrying out attacks, with each tactic having a set of techniques that describe the potential methods used in these attacks. One major application of ATT&CK is the use of its tactic and technique hierarchy by security specialists as a framework for annotating cyber-threat intelligence reports, vulnerability descriptions, threat scenarios, inter alia, to facilitate downstream analyses. To date, the tagging process is still largely done manually. In this technical note, we provide a stratified "task space" characterization of the MITRE ATT&CK text tagging task for organizing previous efforts toward automation using AIML methods, while also clarifying pathways for constructing new methods. To illustrate one of the pathways, we use the task space strata to stage-wise construct our own multi-label hierarchical classification models for the text tagging task via experimentation over general cyber-threat intelligence text -- using shareable computational tools and publicly releasing the models to the security community (via https://github.com/jpmorganchase/MITRE_models). Our multi-label hierarchical approach yields accuracy scores of roughly 94% at the tactic level, as well as accuracy scores of roughly 82% at the technique level. The models also meet or surpass state-of-the-art performance while relying only on classical machine learning methods -- removing any dependence on LLMs, RAG, agents, or more complex hierarchical approaches. Moreover, we show that GPT-4o model performance at the tactic level is significantly lower (roughly 60% accuracy) than our own approach. We also extend our baseline model to a corpus of threat scenarios for financial applications produced by subject matter experts.