{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T15:02:14Z","timestamp":1786978934365,"version":"build-2736575974"},"publisher-location":"Cham","reference-count":27,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032006264","type":"print"},{"value":"9783032006271","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,8,10]],"date-time":"2025-08-10T00:00:00Z","timestamp":1754784000000},"content-version":"vor","delay-in-days":221,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Cyber threat intelligence (CTI) reports are critical for understanding adversarial behaviors but are often unstructured and lack sufficient labeled data, which makes automated extraction of Tactics, Techniques, and Procedures (TTPs) challenging. This paper addresses these issues by introducing TTPFShot, a novel retrieval-based few-shot learning framework that classifies TTPs from CTI texts with minimal labeled data. TTPFShot leverages a vector database to retrieve semantically similar examples from a sentence-based dataset derived from the MITRE ATT&amp;CK framework. These examples are used to construct few-shot prompts that guide large language models to accurately map CTI sentences to the appropriate TTP categories. Comprehensive evaluations on both sentence-based and document-based datasets demonstrate that TTPFShot outperforms existing approaches, such as TTPXHunter, by achieving higher precision, recall, and F1 scores. These results underscore the framework\u2019s ability to mitigate data scarcity issues and improve TTP classification accuracy in real-world settings.<\/jats:p>","DOI":"10.1007\/978-3-032-00627-1_19","type":"book-chapter","created":{"date-parts":[[2025,8,9]],"date-time":"2025-08-09T04:22:24Z","timestamp":1754713344000},"page":"387-408","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["TTP Classification with\u00a0Minimal Labeled Data: A Retrieval-Based Few-Shot Learning Approach"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-4698-5534","authenticated-orcid":false,"given":"Dzenan","family":"Hamzic","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1922-7892","authenticated-orcid":false,"given":"Florian","family":"Skopik","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3813-3151","authenticated-orcid":false,"given":"Max","family":"Landauer","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3259-6972","authenticated-orcid":false,"given":"Markus","family":"Wurzenberger","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9272-6225","authenticated-orcid":false,"given":"Andreas","family":"Rauber","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,8,10]]},"reference":[{"key":"19_CR1","doi-asserted-by":"crossref","unstructured":"Aghaei, E., Niu, X., Shadid, W., Al-Shaer, E.: Securebert: a domain-specific language model for cybersecurity. In: Security and Privacy in Communication Networks: 18th EAI International Conference, SecureComm 2022, pp. 39\u201356 (2023)","DOI":"10.1007\/978-3-031-25538-0_3"},{"key":"19_CR2","doi-asserted-by":"crossref","unstructured":"Alam, M.T., Bhusal, D., Park, Y., Rastogi, N.: Looking beyond IoCs: automatically extracting attack patterns from external CTI. arXiv preprint arXiv:2211.01753 (2022)","DOI":"10.1145\/3607199.3607208"},{"key":"19_CR3","unstructured":"ATT &CK Mitre: Brute force, technique t1110 - enterprise. https:\/\/attack.mitre.org\/techniques\/T1110\/"},{"key":"19_CR4","first-page":"1877","volume":"33","author":"T Brown","year":"2020","unstructured":"Brown, T., et al.: Language models are few-shot learners. Adv. Neural. Inf. Process. Syst. 33, 1877\u20131901 (2020)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"19_CR5","unstructured":"Chen, F., et al.: Adapting to cyber threats: a phishing evolution network (pen) framework for phishing generation and analyzing evolution patterns using large language models. arXiv preprint arXiv:2411.11389 (2024)"},{"key":"19_CR6","unstructured":"CISA: Best practices for Mitre att &ck mapping (2023). https:\/\/www.cisa.gov\/sites\/default\/files\/2023-01\/Best%20Practices%20for%20MITRE%20ATTCK%20Mapping.pdf"},{"key":"19_CR7","unstructured":"Picus Security: Noise to knowledge tackling challenges\u00a0in cyber threat\u00a0intelligence (2023). https:\/\/www.picussecurity.com\/resource\/blog\/from-noise-to-knowledge-tackling-challenges-in-cyber-threat-intelligence"},{"key":"19_CR8","doi-asserted-by":"publisher","unstructured":"Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: BERT: pre-training of deep bidirectional transformers for language understanding. In: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, vol. 1, 4171\u20134186 (2019). https:\/\/doi.org\/10.18653\/v1\/N19-1423","DOI":"10.18653\/v1\/N19-1423"},{"key":"19_CR9","unstructured":"DISA: The Mitre Att &ck framework: using TTPS to understand cyber threats (2023). https:\/\/www.disa.mil\/mitre-attack"},{"key":"19_CR10","doi-asserted-by":"crossref","unstructured":"Fieblinger, R., Alam, M.T., Rastogi, N.: Actionable cyber threat intelligence using knowledge graphs and large language models. arXiv preprint arXiv:2407.02528 (2024)","DOI":"10.1109\/EuroSPW61312.2024.00018"},{"issue":"2","key":"19_CR11","doi-asserted-by":"publisher","first-page":"227","DOI":"10.1007\/s10994-006-6676-4","volume":"68","author":"PA Flach","year":"2006","unstructured":"Flach, P.A.: Precision-recall and ROC curves. Mach. Learn. 68(2), 227\u2013243 (2006). https:\/\/doi.org\/10.1007\/s10994-006-6676-4","journal-title":"Mach. Learn."},{"issue":"3","key":"19_CR12","doi-asserted-by":"publisher","first-page":"24","DOI":"10.1016\/j.jcr.2013.04.002","volume":"4","author":"W Hamza","year":"2013","unstructured":"Hamza, W., Zhang, Y.: Hamming accuracy for classification models in multi-class problems. J. Comput. Res. 4(3), 24\u201332 (2013). https:\/\/doi.org\/10.1016\/j.jcr.2013.04.002","journal-title":"J. Comput. Res."},{"key":"19_CR13","first-page":"9459","volume":"33","author":"P Lewis","year":"2020","unstructured":"Lewis, P., et al.: Retrieval-augmented generation for knowledge-intensive NLP tasks. Adv. Neural. Inf. Process. Syst. 33, 9459\u20139474 (2020)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"19_CR14","doi-asserted-by":"crossref","unstructured":"Mavroeidis, V., Hohimer, R., Casey, T., J\u00f8sang, A.: Threat actor type inference and characterization within cyber threat intelligence. In: 13th International Conference on Cyber Conflict (CyCon) (2021). https:\/\/doi.org\/10.48550\/arXiv.2103.02301","DOI":"10.23919\/CyCon51939.2021.9468305"},{"key":"19_CR15","unstructured":"Micro, T.: Pawn storm uses brute force and stealth against high-value targets (2024)"},{"key":"19_CR16","unstructured":"Microsoft: What is cyber threat intelligence? https:\/\/www.microsoft.com\/en-us\/security\/business\/security-101\/what-is-cyber-threat-intelligence"},{"key":"19_CR17","unstructured":"MITRE: Att &ck threat report annotation model (tram): automatically annotating cyber threat intelligence reports (2020). https:\/\/github.com\/mitre-attack\/tram"},{"key":"19_CR18","unstructured":"AGIR: Automating Cyber Threat Intelligence Reporting with Natural Language Generation. arXiv preprint arXiv:2310.02655 (2023)"},{"key":"19_CR19","unstructured":"Palo Alto Networks: Cyber threat intelligence and Mitre Att &ck framework (2024). https:\/\/www.paloaltonetworks.com\/resources\/cyber-threat-intelligence-mitre-attack"},{"key":"19_CR20","doi-asserted-by":"crossref","unstructured":"Orbinato, V., Barbaraci, M., Natella, R., Cotroneo, D.: Automatic mapping of unstructured cyber threat intelligence: an experimental study (2022)","DOI":"10.1109\/ISSRE55969.2022.00027"},{"issue":"1","key":"19_CR21","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1016\/j.jmlr.2007.10.003","volume":"2","author":"DMW Powers","year":"2007","unstructured":"Powers, D.M.W.: Evaluation: from precision, recall and f-score to roc, informedness, markedness and correlation. J. Mach. Learn. Technol. 2(1), 37\u201363 (2007). https:\/\/doi.org\/10.1016\/j.jmlr.2007.10.003","journal-title":"J. Mach. Learn. Technol."},{"key":"19_CR22","doi-asserted-by":"publisher","unstructured":"Rani, N., Saha, B., Maurya, V., Shukla, S.K.: Ttphunter: automated extraction of actionable intelligence as TTPS from narrative threat reports. In: ACSW \u201923: Proceedings of the 2023 Australasian Computer Science Week, pp. 126\u2013134 (2023). https:\/\/doi.org\/10.1145\/3579375.3579391","DOI":"10.1145\/3579375.3579391"},{"key":"19_CR23","doi-asserted-by":"crossref","unstructured":"Rani, N., Saha, B., Maurya, V., Shukla, S.K.: Ttpxhunter: actionable threat intelligence extraction as TTPS from finished cyber threat reports. arXiv preprint arXiv:2403.03267 (2024)","DOI":"10.1145\/3696427"},{"key":"19_CR24","unstructured":"Rastogi, N., et al.: Inferring cyber threat intelligence \u2013 a knowledge graph-based approach (2023)"},{"key":"19_CR25","unstructured":"Siracusano, G., et al.: Time for action: automated analysis of cyber threat intelligence in the wild. arXiv preprint arXiv:2307.10214 (2023)"},{"issue":"5","key":"19_CR26","doi-asserted-by":"publisher","first-page":"1316","DOI":"10.1016\/j.ipm.2005.08.001","volume":"42","author":"M Sokolova","year":"2006","unstructured":"Sokolova, M., Lapalme, G.: A systematic analysis of performance measures for classification tasks. Inf. Process. Manag. 42(5), 1316\u20131342 (2006). https:\/\/doi.org\/10.1016\/j.ipm.2005.08.001","journal-title":"Inf. Process. Manag."},{"issue":"5","key":"19_CR27","doi-asserted-by":"publisher","first-page":"1316","DOI":"10.1016\/j.ipm.2016.04.002","volume":"42","author":"M Sokolova","year":"2016","unstructured":"Sokolova, M., Lapalme, G.: A systematic analysis of performance measures for classification tasks. Inf. Process. Manag. 42(5), 1316\u20131342 (2016). https:\/\/doi.org\/10.1016\/j.ipm.2016.04.002","journal-title":"Inf. Process. Manag."}],"container-title":["Lecture Notes in Computer Science","Availability, Reliability and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-00627-1_19","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,28]],"date-time":"2026-07-28T13:42:52Z","timestamp":1785246172000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-00627-1_19"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783032006264","9783032006271"],"references-count":27,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-00627-1_19","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"10 August 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ARES","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Availability, Reliability and Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Ghent","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Belgium","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"11 August 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"14 August 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ares-12025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/2025.ares-conference.eu","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}