UniTTP: A Unified Framework for Tactics, Techniques, and Procedures Mapping in Cyber Threats

The increasing complexity of cyber threats necessitates advanced methods for understanding and countering adversarial tactics, techniques, and procedures (TTPs). Despite the support provided by the ATT&CK framework, challenges such as imbalanced sample distribution and technique overlap limit the effective mapping of complex attack patterns. To address these challenges, we propose a framework that integrates language models and advanced artificial intelligence techniques, including hierarchical attention embedding and contrastive learning, to achieve TTP recognition and classification in complex cyber threats. UniTTP consists of five modules: data processing, tactic classification, multi-feature embedding, techniques classification, and LLM post-assistance. By combining these modules, our method not only accurately identifies TTPs within cyber threats, improving the F1 score by 3.23% to 13.66% across different datasets, but also leverages the capabilities of large language models to verify recognition results and deepen the understanding of attack behaviors. This study lays the foundation for robust cyber defense by providing deeper insights into adversary behaviors and enhancing the predictability of complex threats.