TechniqueRAG: Retrieval Augmented Generation for Adversarial Technique
  Annotation in Cyber Threat Intelligence Text
Accurately identifying adversarial techniques in security texts is critical
for effective cyber defense. However, existing methods face a fundamental
trade-off: they either rely on generic models with limited domain precision or
require resource-intensive pipelines that depend on large labeled datasets and
task-specific optimizations, such as custom hard-negative mining and denoising,
resources rarely available in specialized domains.
  We propose TechniqueRAG, a domain-specific retrieval-augmented generation
(RAG) framework that bridges this gap by integrating off-the-shelf retrievers,
instruction-tuned LLMs, and minimal text-technique pairs. Our approach
addresses data scarcity by fine-tuning only the generation component on limited
in-domain examples, circumventing the need for resource-intensive retrieval
training. While conventional RAG mitigates hallucination by coupling retrieval
and generation, its reliance on generic retrievers often introduces noisy
candidates, limiting domain-specific precision. To address this, we enhance
retrieval quality and domain specificity through zero-shot LLM re-ranking,
which explicitly aligns retrieved candidates with adversarial techniques.
  Experiments on multiple security benchmarks demonstrate that TechniqueRAG
achieves state-of-the-art performance without extensive task-specific
optimizations or labeled data, while comprehensive analysis provides further
insights.
682c2a1b09ce6055263a5094
Ahmed Lekssays
claimed_verified
2025-05-20T07:19:55.468Z
6458ac92c16ecb4815dd1d10
https://cdn-avatars.huggingface.co/v1/production/uploads/6458ac92c16ecb4815dd1d10/llkaZ8U-4IEWgtopk2BJs.jpeg
Ahmed Lekssays
user
lekssays
682c2a1b09ce6055263a5095
Utsav Shukla
admin_assigned
2025-05-20T08:54:03.070Z
65c094edb54ab5b37d9d883b
/avatars/81f75c49d31335ff74e24bd37cb89bcb.svg
utsav shukla
user
utsavshukla
682c2a1b09ce6055263a5096
Husrev Taha Sencar
admin_assigned
2025-05-20T08:54:09.925Z
66c6e7ced707a52f9d102f66
/avatars/e7fc2e78babee4765276978aeb42b1aa.svg
Husrev Taha Sencar
user
TahaSencar
682c2a1b09ce6055263a5097
Md Rizwan Parvez
admin_assigned
2025-05-20T08:54:21.776Z
65ae1c4468139e3c42973fe4
/avatars/b065a857dd763410caadea37a2dc01c4.svg
Md Rizwan Parvez
user
mparvez
TechniqueRAG: Retrieval Augmented Generation for Adversarial Technique
  Annotation in Cyber Threat Intelligence Text
Accurately identifying adversarial techniques in security texts is critical
for effective cyber defense. However, existing methods face a fundamental
trade-off: they either rely on generic models with limited domain precision or
require resource-intensive pipelines that depend on large labeled datasets and
task-specific optimizations, such as custom hard-negative mining and denoising,
resources rarely available in specialized domains.
  We propose TechniqueRAG, a domain-specific retrieval-augmented generation
(RAG) framework that bridges this gap by integrating off-the-shelf retrievers,
instruction-tuned LLMs, and minimal text-technique pairs. Our approach
addresses data scarcity by fine-tuning only the generation component on limited
in-domain examples, circumventing the need for resource-intensive retrieval
training. While conventional RAG mitigates hallucination by coupling retrieval
and generation, its reliance on generic retrievers often introduces noisy
candidates, limiting domain-specific precision. To address this, we enhance
retrieval quality and domain specificity through zero-shot LLM re-ranking,
which explicitly aligns retrieved candidates with adversarial techniques.
  Experiments on multiple security benchmarks demonstrate that TechniqueRAG
achieves state-of-the-art performance without extensive task-specific
optimizations or labeled data, while comprehensive analysis provides further
insights.
TechniqueRAG, a domain-specific retrieval-augmented generation framework using LLMs and minimal in-domain examples, achieves high performance in identifying adversarial techniques with reduced resource requirements.
retrieval-augmented generation (RAG) instruction-tuned LLMs zero-shot LLM re-ranking hallucination domain-specific precision adversarial techniques