TTParser: Leveraging LLM for Enhanced Mapping of ATT&CK Tactics, Techniques, and Procedures in Unstructured Cyber Threat Intelligence

Automated extraction of Tactics, Techniques, and Procedures (TTPs) from unstructured Cyber Threat Intelligence (CTI) reports is fundamental for proactive defense. However, prevailing approaches, which often rely on sentence-level classification, suffer from significant limitations. They suffer from two fundamental challenges: (1) they overlook the fine-grained contextual semantics and the inherent hierarchical structure of TTPs; and (2) they fail to capture the dynamic attack procedures that constitute a complete attack narrative.In this paper, we propose TTParser, a framework for extracting and reconstructing Tactics, Techniques, and Procedures (TTPs) from unstructured cyber threat reports. TTParser moves beyond isolated TTP recognition by explicitly modeling both the structured semantics of TTPs and their procedural relationships. The framework follows a two-stage design. First, the TTP Recognition Module combines deep learning with an optimization algorithm to identify TTPs while enforcing hierarchical consistency, and further validates the results using an LLM-based verifier. Second, the Procedure Generation Module employs few-shot prompting to organize the recognized TTPs into coherent and interpretable attack procedures. This design enables TTParser to produce accurate TTP predictions and to reconstruct attacker behaviors in a step-by-step manner. Extensive experiments show that TTParser consistently improves TTP extraction performance and effectively narrows the gap between isolated TTP prediction and actionable threat intelligence.