Retrieval-Constrained Policy Optimization for Attack Technique Extraction from Cyber Threat Intelligence

Computer Science > Cryptography and Security [Submitted on 7 Aug 2026] Retrieval-Constrained Policy Optimization for Attack Technique Extraction from Cyber Threat Intelligence Jiayun Zhang, Junshen Xu, Zejun Xie, Yi Fan Mapping cyber threat intelligence (CTI) text to MITRE ATT&CK techniques is essential for structured threat analysis, yet manual annotation is costly and does not scale. The ATT&CK taxonomy comprises several hundred attack techniques, and a single CTI passage may describe multiple techniques, making accurate and complete extraction challenging. Existing automated approaches fall short in different ways: multi-label classifiers struggle with severe class imbalance and the large label space, while LLM-based methods--retrieval pipelines and fine-tuned generators--optimize token-level objectives that treat technique annotation as sequence generation rather than set prediction, lacking direct supervision on whether the predicted technique set is correct and complete. We propose TTP-R1, a two-stage framework that combines retrieval-augmented supervised fine-tuning (SFT) with reinforcement learning using verifiable rewards (RLVR). A hybrid retriever first narrows the large label space to a candidate set, and a fine-tuned LLM learns to select the correct techniques. We then apply Group Relative Policy Optimization with a decomposed reward that directly supervises the precision, recall, and output format of the predicted technique set. Across four CTI benchmarks, TTP-R1 achieves the best average F1, improving sub-technique-level F1 by 7.4 percentage points over Claude Sonnet 4.5 with retrieval augmentation, while running 28x faster when served as an 8B-parameter model on a single GPU. Comments: Accepted to the AI Agent for Information Retrieval (Agent4IR) Workshop at KDD 2026 Subjects: Cryptography and Security (cs.CR); Computation and Language (cs.CL) Cite as: arXiv:2608.06778 [cs.CR]   (or arXiv:2608.06778v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2608.06778 Focus to learn more Submission history From: Jiayun Zhang [view email] [v1] Fri, 7 Aug 2026 03:52:33 UTC (199 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-08 Change to browse by: cs cs.CL References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)