What Are Adversaries Doing? Automating Tactics, Techniques, and Procedures Extraction: A Systematic Review
Mahzabin Tamanna, Shaswata Mitra, Md Erfan, Ahmed Ryan, Sudip Mittal, Laurie Williams, Md Rayhanur Rahman

TL;DR
This systematic review analyzes 80 studies on automating the extraction of adversary tactics, techniques, and procedures from unstructured text, highlighting recent trends, challenges, and gaps in the field.
Contribution
It provides a comprehensive overview of the current research landscape, identifying dominant methods, emerging approaches, and key limitations in TTP extraction from text.
Findings
Technique-level classification is most common.
Transformer-based models are increasingly used.
Reproducibility is limited by proprietary data and code.
Abstract
Adversaries continuously evolve their tactics, techniques, and procedures (TTPs) to achieve their objectives while evading detection, requiring defenders to continually update their understanding of adversary behavior. Prior research has proposed automated extraction of TTP-related intelligence from unstructured text and mapping it to structured knowledge bases, such as MITRE ATT&CK. However, existing work varies widely in extraction objectives, datasets, modeling approaches, and evaluation practices, making it difficult to understand the research landscape. The goal of this study is to aid security researchers in understanding the state of the art in extracting attack tactics, techniques, and procedures (TTPs) from unstructured text by analyzing relevant literature. We systematically analyze 80 peer-reviewed studies across key dimensions: extraction purposes, data sources, dataset…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
