ARBITRA maps full CTI reports to ATT&CK with expert argumentation
Original title: ARBITRA: Robust Document-Level ATT&CK Extraction via Multi-Expert Argumentation
Specialized LLM experts propose entities from whole reports, then a quantitative argumentation check filters them against document evidence.
ARBITRA extracts MITRE ATT&CK entities from full cyber threat reports instead of splitting them into sentences. Role-specialized LLM experts propose candidates, and a per-candidate quantitative bipolar argumentation framework verifies them using document evidence and rationales. The authors also build reasoning corpora so experts can be fine-tuned for that verification. On extraction benchmarks they report a stronger precision-oriented result than sentence-level pipelines, recent LLM extractors, and frontier models including GPT-5.5, with smaller precision loss under adversarial perturbations.
Unconfirmed: Precision and robustness gains are the authors' benchmark results, not an independent evaluation.
- Perturbation tests cover conflicting TTP statements, cross-report contamination, and semantic poisoning.
- Mean precision degradation is roughly half that of frontier-model baselines.
- Experts are fine-tuned on reasoning-specialized corpora for verification.
- Comparisons include sentence-level pipelines and GPT-5.5.
From the original article
1 min read at arxiv.orgCyber threat intelligence (CTI) reports describe adversary behavior in natural language, but converting them into structured MITRE ATT&CK mappings remains difficult: existing methods decompose reports to sentence-level granularity for extraction, while modern LLMs can work with full reports in a single pass but with noticeable performance degradation.
By Youngjin Jin · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.