arxiv
PublishedOctober 15, 2026 at 4:00 AM
CTI2TTP: Evidence-Grounded TTP Extraction from Cyber Threat Intelligence via Diverge-then-Converge Verification
Publisher summary· verbatim
arXiv:2605.25836v2 Announce Type: replace-cross Abstract: Extracting MITRE ATT&CK techniques from cyber threat intelligence (CTI) reports is an open-set, multi-label problem requiring both high recall (not missing techniques) and high precision (not hallucinating unsupported ones). Existing rule-bas
Stay posted· Newsletter
Three short emails a week: Monday, Wednesday and Friday. Top movers, new models and the most-referenced story.
Your email is used only to send The Bubble Brief. Privacy policy
Discussion
No replies yet. Be first.
Related coverage
More from ARXIV
arxivRCPN: towards robust pseudo-labels in unsupervised CLIP adaptation via consistent prototypes and neighborhoods5harxivCan Graph Learning Learn Circuits?5harxivBeyond Fixed Acquisition Functions: Temporal Difference Active Learning for Perturbation Discovery5harxivFrom Events to Reasoning: Hierarchical Rule Composition over Explicit States5hThe Bubble Brief
MON · WED · FRIRead AI insights every Monday, Wednesday and Friday — top movers, new models, story of the week.
Your email is used only to send The Bubble Brief. Privacy policy
Originally published on arxiv ↗