title: TechniqueRAG: Retrieval Augmented Generation for Adversarial Technique
    Annotation in Cyber Threat Intelligence Text
summary: Accurately identifying adversarial techniques in security texts is critical
  for effective cyber defense. However, existing methods face a fundamental
  trade-off: they either rely on generic models with limited domain precision or
  require resource-intensive pipelines that depend on large labeled datasets and
  task-specific optimizations, such as custom hard-negative mining and denoising,
  resources rarely available in specialized domains.
    We propose TechniqueRAG, a domain-specific retrieval-augmented generation
  (RAG) framework that bridges this gap by integrating off-the-shelf retrievers,
  instruction-tuned LLMs, and minimal text-technique pairs. Our approach
  addresses data scarcity by fine-tuning only the generation component on limited
  in-domain examples, circumventing the need for resource-intensive retrieval
  training. While conventional RAG mitigates hallucination by coupling retrieval
  and generation, its reliance on generic retrievers often introduces noisy
  candidates, limiting domain-specific precision. To address this, we enhance
  retrieval quality and domain specificity through zero-shot LLM re-ranking,
  which explicitly aligns retrieved candidates with adversarial techniques.
    Experiments on multiple security benchmarks demonstrate that TechniqueRAG
  achieves state-of-the-art performance without extensive task-specific
  optimizations or labeled data, while comprehensive analysis provides further
  insights.
paper_authors._id: 682c2a1b09ce6055263a5094
paper_authors.name: Ahmed Lekssays
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2025-05-20T07:19:55.468Z
paper_authors._id: 6458ac92c16ecb4815dd1d10
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/6458ac92c16ecb4815dd1d10/llkaZ8U-4IEWgtopk2BJs.jpeg
paper_authors.fullname: Ahmed Lekssays
paper_authors.type: user
paper_authors.user: lekssays
paper_authors._id: 682c2a1b09ce6055263a5095
paper_authors.name: Utsav Shukla
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-05-20T08:54:03.070Z
paper_authors._id: 65c094edb54ab5b37d9d883b
paper_authors.avatarUrl: /avatars/81f75c49d31335ff74e24bd37cb89bcb.svg
paper_authors.fullname: utsav shukla
paper_authors.type: user
paper_authors.user: utsavshukla
paper_authors._id: 682c2a1b09ce6055263a5096
paper_authors.name: Husrev Taha Sencar
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-05-20T08:54:09.925Z
paper_authors._id: 66c6e7ced707a52f9d102f66
paper_authors.avatarUrl: /avatars/e7fc2e78babee4765276978aeb42b1aa.svg
paper_authors.fullname: Husrev Taha Sencar
paper_authors.type: user
paper_authors.user: TahaSencar
paper_authors._id: 682c2a1b09ce6055263a5097
paper_authors.name: Md Rizwan Parvez
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-05-20T08:54:21.776Z
paper_authors._id: 65ae1c4468139e3c42973fe4
paper_authors.avatarUrl: /avatars/b065a857dd763410caadea37a2dc01c4.svg
paper_authors.fullname: Md Rizwan Parvez
paper_authors.type: user
paper_authors.user: mparvez
paper_title: TechniqueRAG: Retrieval Augmented Generation for Adversarial Technique
    Annotation in Cyber Threat Intelligence Text
paper_summary: Accurately identifying adversarial techniques in security texts is critical
  for effective cyber defense. However, existing methods face a fundamental
  trade-off: they either rely on generic models with limited domain precision or
  require resource-intensive pipelines that depend on large labeled datasets and
  task-specific optimizations, such as custom hard-negative mining and denoising,
  resources rarely available in specialized domains.
    We propose TechniqueRAG, a domain-specific retrieval-augmented generation
  (RAG) framework that bridges this gap by integrating off-the-shelf retrievers,
  instruction-tuned LLMs, and minimal text-technique pairs. Our approach
  addresses data scarcity by fine-tuning only the generation component on limited
  in-domain examples, circumventing the need for resource-intensive retrieval
  training. While conventional RAG mitigates hallucination by coupling retrieval
  and generation, its reliance on generic retrievers often introduces noisy
  candidates, limiting domain-specific precision. To address this, we enhance
  retrieval quality and domain specificity through zero-shot LLM re-ranking,
  which explicitly aligns retrieved candidates with adversarial techniques.
    Experiments on multiple security benchmarks demonstrate that TechniqueRAG
  achieves state-of-the-art performance without extensive task-specific
  optimizations or labeled data, while comprehensive analysis provides further
  insights.
paper_ai_summary: TechniqueRAG, a domain-specific retrieval-augmented generation framework using LLMs and minimal in-domain examples, achieves high performance in identifying adversarial techniques with reduced resource requirements.
paper_ai_keywords: retrieval-augmented generation (RAG) instruction-tuned LLMs zero-shot LLM re-ranking hallucination domain-specific precision adversarial techniques