TTP-Tagger : An LLM-Driven Framework for Advancing ATT&CK Label Classification via Data Augmentation and Full Fine-Tuning

Project Overview

This repository contains the dataset and result used to run experiments for the paper: "TTP-Tagger : An LLM-Driven Framework for Advancing ATT&CK Label Classification via Data Augmentation and Full Fine-Tuning " We propose TTP-Tagger, an LLM-driven framework that advances ATT&CK label classification by leveraging data augmentation and full fine-tuning techniques

Project Structure

TTP-Tagger/
├── Dataset/ # Dataset directory
│ ├── Aug-Dataset/ │ │ ├── Test-aug/ # Augmented Test Set
│ │ ├── Train-aug # Augmented Train Set
│ │ └── Valid-aug # Augmented Valid Set
│ └── Original-dataset/ │ ├── test-final.json/ # Original Test Set
│ ├── train-final.json/ # Original Train Set
│ └── validation-final.json # Original valida Set
└── Methods and Results/ # Implementation & Evaluation
├── Adema/ # Adema Method
├── Closed-source / # Closed-source models
├── Open-source / # Open-source model results
├── RAG/ # RAG Method

Hyperparameter Description

The relevant hyperparameter configurations are described in detail within the paper.

Closed-Source LLM Names

Deepseek-v3.1,Qwen-plus,DS-DL-RL-70b,GLM-4.5

Open-Source LLM Names

qwen2-7b,glm4-9b,gpt-oss-20b

Aug_prompts

You are an expert in the field of cybersecurity. Please augment and enrich the given input content by expanding it into a more detailed and comprehensive attack scenario description. During the augmentation process, you must strictly preserve the original semantic meaning and must not explicitly introduce any ATT&CK tactic or technique labels in the expanded text. In addition, you must ensure that the expanded description does not implicitly suggest any specific phase or category of attacker behavior through contextual clues, such as sequencing patterns, temporal characteristics, or operational priorities that could be mapped to known classification frameworks. The enriched output should describe only the attack behavior itself, without revealing its corresponding classification labels, whether explicitly or implicitly.