Evo-TTP: Generative and robust prediction of novel cyber threat tactics using adversarial fine-tuning of large language models

What is it about?

Value to the Scientific Literature: The modern cybersecurity landscape presents a quintessential "Big Data" paradox: defenders possess vast amounts of retrospective telemetry, yet predictive intelligence regarding future threats remains critically scarce. Current methodologies for Cyber Threat Intelligence (CTI) are largely reactive or rely on static dictionary lookups. This paper bridges this gap by introducing a paradigm shift from simple text generation to High-Dimensional Semantic Mining. By parsing the MITRE ATT&CK Enterprise Matrix v18.0 as a dense knowledge graph, we uncover hidden correlations defined as "Structural Holes" that represent the undocumented "Zero-Day" tactics of the future. This work is valuable because it demonstrates how Adversarial Reinforcement Learning can be applied to large-scale cognitive graphs to "pre-compute" future threat vectors before they appear in the wild.

Featured Image

Photo by Google DeepMind on Unsplash

Photo by Google DeepMind on Unsplash

Why is it important?

This study advances foundational work by Stein (2025) on CTI data mining and Angioni et al. (2025) on adversarial robustness in machine learning. While previous studies focused on extracting known entities from unstructured text, our framework employs Adversarial Group Relative Policy Optimization (GRPO) to synthetically generate novel and feasible threats. Crucially, we address the specific "research issue" of Large Language Model (LLM) brittleness identified by Chen & Adebayo (2025), successfully improving model robustness against adversarial injection attacks by 32% compared to standard fine-tuning methods.