关键词: 网络威胁情报（CTI）, TTPs, ATT&, CK, 数据增强, 大语言模型, 监督微调

Abstract: The MITRE ATT&CK framework defines 14 tactics and 625 techniques that cover the full spectrum of cyber attacks. It has progressively become the de facto standard for describing Tactics, Techniques, and Procedures (TTPs) in cyber threat intelligence. Current research often transforms the task of identifying and extracting TTPs into a multi-class classification problem at the sentence level, employing deep learning and large language models based on prompt engineering. However, issues such as the dominance of small sample categories in datasets and the performance limitations of multi-class models result in low coverage and accuracy in category identification. This paper proposes a method that combines ChatGPT data augmentation with instruction-supervised fine-tuning of large language models, effectively addressing the multi-class classification problem for technique categories at the sentence level. The ChatGPT data augmentation method enriches sample diversity while preserving the original sample semantics, providing high-quality training data to support high-performance recognition in small sample learning. Experimental results demonstrate the superiority of this data augmentation method. The instruction-supervised fine-tuning of the large language model overcomes the performance bottleneck of deep learning multi-class models, achieving full coverage of the 625 technique categories. The Precision, Recall, and F1-score reach 86.2%, 89.9%, and 88.0%, respectively, surpassing existing research.

Key words: cyber threat intelligence(CTI), TTPs, ATT&, CK, data augmentation, large language model, supervised fine-tuning(SFT)