标题： SynthCTI：LLM驱动的合成CTI生成以增强MITRE技术映射 显示英文标题

标题： SynthCTI: LLM-Driven Synthetic CTI Generation to enhance MITRE Technique Mapping

摘要： 网络威胁情报（CTI）挖掘涉及从非结构化威胁数据中提取结构化见解，使组织能够理解和应对不断变化的对手行为。 CTI挖掘中的一个关键任务是将威胁描述映射到MITRE ATT&CK技术。 然而，这一过程通常需要人工完成，需要专家知识和大量努力。 自动方法面临两个主要挑战：高质量标记的CTI数据稀缺以及类别不平衡，其中许多技术只有很少的例子。 虽然特定领域的大型语言模型（LLMs）如SecureBERT表现出更好的性能，但大多数最新研究集中在模型架构上，而不是解决数据限制问题。 在本工作中，我们提出了SynthCTI，这是一个数据增强框架，旨在为代表性不足的MITRE ATT&CK技术生成高质量的合成CTI句子。 我们的方法使用基于聚类的策略从训练数据中提取语义上下文，并指导LLM生成在词汇上多样化且语义忠实的合成CTI句子。 我们在两个公开可用的CTI数据集CTI-to-MITRE和TRAM上评估SynthCTI，使用不同能力的LLMs。 引入合成数据带来了稳定的宏观F1改进：例如，ALBERT从0.35提升到0.52（相对增长48.6%），而SecureBERT达到0.6558（从0.4412提升）。 值得注意的是，使用SynthCTI增强的小型模型表现优于未进行增强的大模型，这表明数据生成方法在构建高效有效的CTI分类系统中的价值。 显示英文摘要

摘要： Cyber Threat Intelligence (CTI) mining involves extracting structured insights from unstructured threat data, enabling organizations to understand and respond to evolving adversarial behavior. A key task in CTI mining is mapping threat descriptions to MITRE ATT\&CK techniques. However, this process is often performed manually, requiring expert knowledge and substantial effort. Automated approaches face two major challenges: the scarcity of high-quality labeled CTI data and class imbalance, where many techniques have very few examples. While domain-specific Large Language Models (LLMs) such as SecureBERT have shown improved performance, most recent work focuses on model architecture rather than addressing the data limitations. In this work, we present SynthCTI, a data augmentation framework designed to generate high-quality synthetic CTI sentences for underrepresented MITRE ATT\&CK techniques. Our method uses a clustering-based strategy to extract semantic context from training data and guide an LLM in producing synthetic CTI sentences that are lexically diverse and semantically faithful. We evaluate SynthCTI on two publicly available CTI datasets, CTI-to-MITRE and TRAM, using LLMs with different capacity. Incorporating synthetic data leads to consistent macro-F1 improvements: for example, ALBERT improves from 0.35 to 0.52 (a relative gain of 48.6\%), and SecureBERT reaches 0.6558 (up from 0.4412). Notably, smaller models augmented with SynthCTI outperform larger models trained without augmentation, demonstrating the value of data generation methods for building efficient and effective CTI classification systems.