Source-linked AI summary
On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptions
Reza Fayyazi, Shanchieh Jay Yang
TL;DR
Evidence on using LLMs to interpret cyberattack descriptions and map them to ATT&CK tactics was limited. The paper compares direct LLM use with supervised fine-tuning of smaller models, finding that fine-tuning gives more focused tactic distinctions while direct LLMs offer broader interpretations.
Problem
Evidence on LLMs interpreting cyberattack descriptions and mapping them to ATT&CK tactics was limited, despite the need to inform their use in cybersecurity operations.
Source: §1 · p. 2Method
Results
Fine-tuned small-scale LLMs provide more focused tactic differentiation, while direct LLMs offer broader but less precise interpretations of TTP descriptions.
Source: §1 · p. 2Takeaways & Limitations
With representative labeled training data, SFT is the better approach; otherwise, prompted and adapted state-of-the-art LLMs can provide a reference for further examination.
Source: §7 · p. 12SecureBERT-SFT overfitted to ATT&CK, reaching 85% accuracy there but 30% on CAPEC descriptions.
Source: §4.4 · p. 7
Abstract
from arXiv · showhide
The volume, variety, and velocity of change in vulnerabilities and exploits have made incident threat analysis challenging with human expertise and experience along. Tactics, Techniques, and Procedures (TTPs) are to describe how and why attackers exploit vulnerabilities. However, a TTP description written by one security professional can be interpreted very differently by another, leading to confusion in cybersecurity operations or even business, policy, and legal decisions. Meanwhile, advancements in AI have led to the increasing use of Natural Language Processing (NLP) algorithms to assist the various tasks in cyber operations. With the rise of Large Language Models (LLMs), NLP tasks have significantly improved because of the LLM's semantic understanding and scalability. This leads us to question how well LLMs can interpret TTPs or general cyberattack descriptions to inform analysts of the intended purposes of cyberattacks. We propose to analyze and compare the direct use of LLMs (e.g., GPT-3.5) versus supervised fine-tuning (SFT) of small-scale-LLMs (e.g., BERT) to study their capabilities in predicting ATT&CK tactics. Our results reveal that the small-scale-LLMs with SFT provide a more focused and clearer differentiation between the ATT&CK tactics (if such differentiation exists). On the other hand, direct use of LLMs offer a broader interpretation of cyberattack techniques. When treating more general cases, despite the power of LLMs, inherent ambiguity exists and limits their predictive power. We then summarize the challenges and recommend research directions on LLMs to treat the inherent ambiguity of TTP descriptions used in various cyber operations.
1 INTRODUCTION
Ambiguous TTP descriptions can lead analysts to infer different attacker intents, motivating a comparison of direct LLM use and supervised fine-tuning for mapping cyberattack descriptions to ATT&CK tactics. The study also identifies limits of both approaches and recommends directions for addressing ambiguity.
Introduction
- TTP descriptions can support different tactic interpretations: DLL side-loading is associated with Privilege-Escalation, Defense-Evasion, and Persistence, but may also be read as Execution.The paper frames this ambiguity as a challenge for analysts interpreting the same description.Source: §1 · p. 1
- The study compares direct use of GPT-3.5 and Bard with supervised fine-tuning of BERT and SecureBERT to map ATT&CK and CAPEC attack descriptions to tactics.The authors describe this as the first formal comparison, to their knowledge, of these practical approaches.Source: §1 · p. 2
- The authors report that fine-tuned small-scale LLMs offer more precise but less flexible tactic differentiation, while direct LLM use gives broader but less precise interpretations.The distinction applies when tactic differentiation exists and is needed.Source: §1 · p. 2
- The study designs prompts and fine-tuning for multi-label overlap and ambiguity, identifies two inherent ambiguity types, and recommends prompt adaptation, self-supervised learning, and reinforcement learning.The proposed directions aim to address ambiguity, evolving vulnerabilities, and usable security needs in cyber operations.Source: §1 · p. 2
2 RELATED WORKS
Prior work applies NLP across cybersecurity and to TTP classification, while this section identifies gaps in document-level, multi-label, and direct LLM-based TTP interpretation. It also traces the shift from early transformer models to much larger generative LLMs.
2.1 Large Language Models
- BERT [10] and RoBERTa [21] advanced contextual language modeling, while GPT-3 and Bard scaled to over 175 billion and 137 billion parameters, respectively.BERT had around 340 million parameters and RoBERTa around 355 million; larger models were described as capable of human-like text generation and complex pattern identification [40] [47].Source: §2.1 · p. 2
2.2 NLP for Cybersecurity Operations
- Cybersecurity NLP research addresses misinformation and phishing, malware classification, exploitability and vulnerability assessment, CVSS prediction, and intrusion detection,,,,,, [31],,,,, [37],,.The cited work spans fake-news identification, phishing detection, malware classification, vulnerability analysis, CVSS scoring, and attack-pattern characterization.Source: §2.2 · p. 2
2.3 NLP for TTP interpretations
- Prior TTP studies used NLP and machine learning to extract, classify, rank, or relate ATT&CK techniques and tactics, [36],,,,, [33].TRAM requires human review of labels; Legoy found TF-IDF with Linear-SVM performed best, while Haque et al. ranked techniques using TF-IDF and cosine similarity.Source: §2.3 · p. 3
- Small-scale language models have also been applied to TTP classification, including SentenceBERT, BERT, RoBERTa, and SecureBERT,,,.TIM classified sets of three descriptions using five techniques and one tactic, while TTPHunter maps transformer outputs with a linear classifier; SecureBERT outperformed traditional ML models, but was not compared with BERT.Source: §2.3 · p. 3
- Earlier studies largely lacked document-level, multi-label TTP analysis and direct GPT-3.5 comparison; this work addresses these gaps and evaluates CAPEC against ATT&CK.The authors also note that prior studies reported no publicly available datasets for TTP classification.Source: §2.3 · p. 3
3 METHODOLOGY & EXPERIMENTAL DESIGN
The study compares direct LLM use with supervised fine-tuning of small-scale models to predict one or more ATT&CK tactics from cyberattack descriptions, addressing limited labeled data, multi-tactic ambiguity, and prompt design.
3.1 Datasets
- The training corpus contained 618 ATT&CK descriptions labeled across 14 tactics, including multi-tactic mappings, a tractable middle ground between 196 techniques/411 sub-techniques and 3–7 kill-chain stages.The authors selected ATT&CK for its industry adoption and associated descriptions; they describe the 618 labeled examples as reflecting limited real-world data availability.Source: §3.1 · p. 3
- ATT&CK descriptions frequently combined Persistence, Privilege-Escalation, and/or Defense-Evasion; Privilege-Escalation was the sole tactic in only 3 of 97 descriptions.Source: §3.1 · p. 3
- For unseen-description evaluation, the authors mapped 177 of 593 CAPEC descriptions to ATT&CK tactics, while noting this indirect human-expert mapping may be inconsistent and overlaps were greater.They also collected 100 IMDB reviews to test whether models would predict NONE for generic, non-cybersecurity text.Source: §3.1 · pp. 3–4
3.2 Supervised Fine-Tuning of Small-scale LLMs
- They fine-tuned BERT-base and cybersecurity-pretrained SecureBERT as 14-output multi-label classifiers, using sigmoid probabilities thresholded above 0.5 for tactic labels.Training used 5-fold cross-validation with 25 epochs per fold; the authors chose base models and targeted fine-tuning as a practical approach for limited labeled data.Source: §3.2 · p. 4
3.3 Prompt Engineering
- Prompts asked GPT-3.5 and Bard to return ATT&CK tactic names or NONE for non-tactic text; added constraints reduced but did not eliminate Bard's extra commentary.Source: §3.3 · p. 5
4 RESULTS & DISCUSSION
The results compare fine-tuned small-scale models with prompted LLMs on ATT&CK and CAPEC descriptions, finding that performance depends on representative labeled data and is limited by ambiguity in the descriptions.
4 RESULTS & DISCUSSION
- Overall evaluation used Micro-F1 and exact-match Accuracy, alongside per-tactic Precision, Recall, and F1.Micro-F1 aggregates contributions across classes, while exact-match Accuracy requires all labels to be predicted correctly.Source: §4 · p. 5
4.1 Evaluation of SFT of Small-scale-LLMs
- Across 5-fold validation of 618 descriptions and 14 tactics, BERT-SFT and SecureBERT-SFT showed reasonable capability, with a small overall advantage for SecureBERT-SFT.The authors selected SecureBERT-SFT’s best-performing fold for subsequent comparisons; its reported F1-scores were at the 0.8 and 0.9 levels, compared with 0.6–0.7 reported by similar works.Source: §4.1 · p. 6, Table 2 · p. 6
4.2 Direct Use of LLMs: GPT vs. Bard
- GPT-3.5 performed better than Bard, which produced 45 non-ATT&CK labels that were disregarded for comparison; GPT-3.5 produced one invalid label.The authors chose GPT-3.5 for the remaining comparisons, while noting that disregarding Bard’s outlier predictions may not be entirely fair and highlights a limitation of direct LLM use.Source: §4.2 · p. 6, Table 4 · p. 6
4.3 LLM vs. SFT of small-scale-LLMs (ATT&CK)
- On ATT&CK, SecureBERT-SFT focused on individual tactics while GPT-3.5 predicted more broadly; SecureBERT-SFT struggled with Lateral-Movement, while GPT-3.5 matched it on Impact.The paper attributes Lateral-Movement errors to tactic overlap in the descriptions and notes that Impact descriptions were more direct and unambiguous.Source: §4.3 · p. 7, Figure 2 · p. 7
- SecureBERT-SFT outperformed GPT-3.5 in predicting ATT&CK tactics across the full dataset.The comparison used a SecureBERT-SFT model trained on about 80% of the data and tested on the full dataset, to compare with GPT-3.5’s Internet-data exposure.Source: §4.3 · p. 6, Table 5 · p. 7
4.4 LLM vs. SFT of small-scale-LLMs (CAPEC)
- On CAPEC, neither model matched its ATT&CK performance; GPT-3.5 handled ambiguity better despite equal accuracy, while SecureBERT-SFT overfit its training distribution.SecureBERT-SFT had 85% accuracy on ATT&CK but 30% on CAPEC. Of 177 CAPEC descriptions, both models were at least partially correct on 50 and entirely wrong on 61; the authors recommend SFT when labeled training data is representative, and prompted LLMs as a reference otherwise.Source: §4.4 · pp. 7–8
4.5 Specific Cases
- For a generic description, SecureBERT-SFT correctly identified the tactic by attending to ‘proxy’, while GPT-3.5 predicted ‘NONE’; for a long, ambiguous description, GPT-3.5 included ‘Lateral-Movement’ among four tactics while SecureBERT predicted ‘NONE’.Source: §4.5 · p. 9
- For an account-lockout description mapped to Impact, neither model predicted Impact: SecureBERT-SFT returned NONE and GPT-3.5 predicted Defense-Evasion.The authors attribute the failure to a missing implicit link between the technique and its effect, and conclude that ambiguity can confound both approaches.Source: §4.5 · p. 10
5 DISCUSSION: FROM CHALLENGES TO RECOMMENDATIONS
TTP interpretation remains limited by ambiguities in descriptions and ATT&CK mappings, while the paper recommends improving prompting, model training, continual learning, adversarial-content detection, and explainability.
5.1 Challenges: LLMs for TTP interpretation
- Ambiguity arises from descriptions implying multiple tactics, mixing attacker method and purpose, and conflating user or organizational Impact with technique effects; ATT&CK’s expanding multi-tactic mappings compound it.Source: §5.1 · pp. 10–11
- SFT models aim to distinguish tactics, whereas GPT-3.5 is not inherently designed to do so, a difference underlying their observed performance disparities on ambiguous descriptions.Source: §5.1 · p. 11
5.2 Recommendation: Self-Supervised LLMs
- Prompt engineering requires iterative attention to context, examples, and structure, while fine-tuning can use more examples than fit in a prompt.Source: §5.2 · p. 11
- Cybersecurity-focused fine-tuning could improve tactic differentiation and support threat analysis and detection, but effective training remains open and requires substantial high-quality data; small-scale SecureBERT fine-tuning was insufficient.Source: §5.2 · p. 11
- Reinforcement Learning with Human Feedback may reduce ambiguity [5], but ambiguity in prompts and responses can cause misinterpretation and enable adversarial attacks that warrant documentation and study.Source: §5.2 · p. 11
- Continual learning from new cybersecurity incidents could keep models current, including open-source LLAMA-2 [42], though fine-tuning it is resource-intensive and PEFT methods such as LoRA and QLoRA [9] may reduce training parameters.Source: §5.2 · p. 11
- Future work could use self-supervised metrics to detect adversarial content and provide explanations, since analysts need to understand and trust predictions, potentially through text highlighting or pop-up explanations.Source: §5.2 · p. 11
6 ETHICAL CONCERNS
The authors see no ethical concern because the study analyzes practical uses of LLMs rather than discovering vulnerabilities or exploits. They emphasize that the community should recognize and address ambiguity in TTP descriptions, which adversaries could exploit.
6 ETHICAL CONCERNS
- The study does not directly discover vulnerabilities or exploits, so the authors do not identify an ethical concern with this research.It analyzes practical uses of LLMs to interpret unstructured TTP descriptions.Source: §6 · p. 11
- Although adversaries could exploit ambiguity in TTP descriptions, the authors urge the community to recognize LLM limitations and work to alleviate that ambiguity.The findings are intended to inform reasonable expectations for cybersecurity professionals using LLMs.Source: §6 · p. 11
7 CONCLUDING REMARKS
The study finds substantial ambiguity and overlap in TTP descriptions, comparing direct LLM use with fine-tuned small models under practical cybersecurity constraints. Its conclusions favor fine-tuning when representative labeled data is available, while recommending adapted generative LLMs as references otherwise.
7 CONCLUDING REMARKS
- The study presents a comparative analysis of direct LLM use and fine-tuning small models for TTP interpretation, considering practical constraints faced by cybersecurity practitioners.The authors describe it as the first such comparative analysis to their knowledge.Source: §7 · pp. 11–12
- SecureBERT-SFT outperformed GPT-3.5 on ATT&CK descriptions, but neither approach performed at the same level on CAPEC descriptions.The study also reports that small-scale LLM fine-tuning produced more focused and clearer tactic classifications.Source: §7 · p. 11
- Direct LLM use offers broader, flexible TTP interpretation and can expose ambiguity and overlap, despite not accurately predicting ATT&CK tactics.The authors attribute this versatility to language generation and comprehension of a wider range of Internet texts.Source: §7 · pp. 11–12
- When representative labeled training data is available, fine-tuning small-scale LLMs is preferable; otherwise, adapted state-of-the-art LLMs can provide a reference for further examination.The authors recommend proper prompt engineering and adaptation for the latter use.Source: §7 · p. 12
- Future work should address continual learning, explainability, and inherent ambiguity to improve the accuracy, reliability, and understandability of cybersecurity LLM tools.The authors call for more nuanced, effective, and context-aware applications of generative AI in cybersecurity.Source: §7 · p. 12