# CTI2TTP: Evidence-Grounded TTP Extraction from Cyber Threat Intelligence via Diverge-then-Converge Verification

arXiv: https://arxiv.org/abs/2605.25836 · HTML: https://mlsanity.com/paper/2605.25836/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 37 references that are in the map.
- First posted on arXiv 25 May 2026.

## Builds on (most cited first, 10 of 10)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Self-Refine: Iterative Refinement with Self-Feedback](https://mlsanity.com/paper/2303.17651/) (2023)
- [Scaling Laws for Reward Model Overoptimization](https://mlsanity.com/paper/2210.10760/) (2022)
- [AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports](https://mlsanity.com/paper/2111.07093/) (2021)
- [Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI](https://mlsanity.com/paper/2211.01753/) (2022)
- [EXTRACTOR: Extracting Attack Behavior from Threat Reports](https://mlsanity.com/paper/2104.08618/) (2021)
- [MedCodER: A Generative AI Assistant for Medical Coding](https://mlsanity.com/paper/2409.15368/) (2024)
- [Code Like Humans: A Multi-Agent Solution for Medical Coding](https://mlsanity.com/paper/2509.05378/) (2025)
- [Information Extraction from Visually Rich Documents using LLM-based Organization of Documents into Independent Textual Segments](https://mlsanity.com/paper/2505.13535/) (2025)
- [Information Extraction From Fiscal Documents Using LLMs](https://mlsanity.com/paper/2511.10659/) (2025)

## Built on by (most cited first, 1 of 1)

- [Ranked by the Matcher: A Reproducibility Audit of Knowledge Graph Extraction from Threat Reports](https://mlsanity.com/paper/2609.01671/) (2026)

## Abstract (arXiv)

Extracting MITRE ATT&CK techniques from cyber threat intelligence (CTI) reports is an open-set, multi-label problem requiring both high recall (not missing techniques) and high precision (not hallucinating unsupported ones). Existing rule-based, supervised, and LLM-based methods struggle to achieve both: rule-based and supervised approaches lack generalizability across diverse attack descriptions, while LLM-based approaches that couple candidate generation and validation within a single inference step suffer from limited recall and precision simultaneously. We propose CTI2TTP, which addresses this challenge through a diverge-then-converge design inspired by how human analysts work: first extracting broadly, then verifying rigorously. Reports are first decomposed into atomic behaviors, each anchored by a deterministic span localization stage to a specific evidence window in the source text. Candidate techniques are then proposed broadly for each behavior, and a convergent verification stage retains only candidates supported by both the localized evidence and the authoritative MITRE definition. We contribute two evaluation resources, a cleaned TRAM benchmark (TRAM-Clean) and a new annotated dataset (CTI2TTP-Bench), to address known annotation noise in existing benchmarks and elevate the task to document-level TTP extraction. On TRAM-Clean and CTI2TTP-Bench, CTI2TTP achieves 76.48% and 87.39% macro-F1 respectively, outperforming chain-of-thought prompting with the same backbone by 63.5% and 29.4%.