Dual-Tower TTP Semantic Matching Method Based on Soft–Hard Label Supervision and Gated Binary Interaction

Abstract

Existing methods for identifying Tactics, Techniques, and Procedures (TTPs) from complex cyber-attack descriptions face three core challenges: (1) severe semantic asymmetry between unstructured attack narratives and standardized TTP definitions; (2) continuously distributed semantic relations that cannot be fully captured by hard-label supervision; and (3) an open, long-tailed TTP taxonomy that impairs model generalization. To address these limitations, we introduce DTGBI-TM, a lightweight dual-tower semantic matching framework that integrates soft-label supervision, hierarchical hard-negative sampling, and gated binary interaction modeling. The model separately encodes attack descriptions and TTP definitions and employs a gated interaction module to adaptively fuse shared and divergent semantics, enabling fine-grained asymmetric alignment. A confidence-guided soft–hard collaborative supervision mechanism unifies weighted classification, semantic regression, and contrastive consistency into a multi-objective loss, dynamically rebalancing gradients to mitigate long-tail effects. Leveraging ATT & CK hierarchical priors, the model further performs in-tactic and cross-tactic hard-negative sampling to enhance semantic discrimination. Experiments on a real-world corpus demonstrate that DTGBI-TM achieves 98.53% F1 in semantic modeling and 79.77% Top-1 accuracy in open-set TTP prediction, while maintaining high inference efficiency and scalability in deployment.

1. Introduction

Accurately identifying Tactics, Techniques, and Procedures (TTPs) from unstructured cyber-attack descriptions is a core task in threat intelligence analysis [1,2]. This task involves three major challenges: First, attack narratives are concrete, diverse, and often colloquial, whereas TTP definitions are highly abstract and standardized [3]. The mismatch in linguistic style and semantic granularity makes direct alignment difficult. Second, a single description may correspond to multiple TTPs with varying semantic intensity, and these associations form a continuous spectrum that cannot be effectively represented by hard-label binary classification frameworks [4]. Third, real-world TTP taxonomies are dynamic and open-ended, while annotated data typically exhibit long-tailed distributions, requiring models to generalize to unseen labels and remain robust under sparse samples [5].

Existing research generally falls into three methodological directions. Classification-based approaches treat TTP identification as a multi-label prediction task using CNNs [6,7], BiLSTMs [8,9,10], or fine-tuned BERT-derived models [11,12,13]. Although easy to deploy, these methods rely on a closed-set assumption and generalize poorly to novel or evolving TTPs. Retrieval-based approaches project attack descriptions and TTP definitions into a shared semantic space and perform similarity-based matching [14,15,16]. However, their symmetric encoding architectures, such as dot-product similarity on single-vector embeddings, limit their ability to capture asymmetric semantic relations between free-form descriptions and standardized TTP labels [17,18]. Large language model (LLM)-based approaches employ GPT- [19,20], T5- [21,22,23], or instruction-tuned models for direct label reasoning [24,25], often with few-shot prompting. While these models provide strong semantic understanding, they incur high inference costs and lack reliable confidence estimation, making large-scale operational deployment difficult [26,27].

Overall, existing methods face fundamental limitations: classification models do not support dynamic TTP taxonomies; retrieval approaches struggle with asymmetric semantics relationships, where the mismatch between semantic representations leads to alignment difficulties; and LLM-based systems, though powerful, remain computationally expensive and operationally opaque. These issues become more pronounced when dealing with emerging or evolving attack behaviors, highlighting the need for a lightweight solution that balances inference efficiency with open-set generalization capability.

To address these challenges, we propose DTGBI-TM (Dual-Tower Gated Binary Interaction Model for TTP Matching), a lightweight semantic matching framework that integrates several novel mechanisms to overcome the limitations of existing approaches. DTGBI-TM combines soft-label supervision, hierarchical hard-negative sampling, and gated binary interaction modeling. The soft-label supervision enhances model flexibility by incorporating continuous-label learning, while hierarchical hard-negative sampling improves robustness by better handling long-tailed distributions. Most importantly, the gated binary interaction modeling addresses this limitation by explicitly learning both shared and differential semantic pathways. This allows DTGBI-TM to capture the complex, asymmetric nature of the interactions between attack descriptions and TTP definitions, providing a more nuanced and accurate semantic representation.

The main contributions of this work are as follows:

• Soft–hard collaborative supervision. We introduce a confidence-guided mechanism that extends TTP matching from binary classification to a hybrid discrete-classification + continuous-regression paradigm, preserving fine-grained semantics of boundary samples.
• Hierarchical hard-negative sampling. Leveraging ATT&CK hierarchical priors, we design intra-tactic hard-negative sampling via temperature-scaled similarity softmax among sibling techniques, and cross-tactic hard-negative sampling through tactic-level anchoring based on inverse weighted semantic distance, achieving both local confusion and global coverage.
• Gated binary interaction modeling. We propose a semantic interaction module that explicitly models deep interactions between attack descriptions and TTP definitions. A dimension-wise gating mechanism adaptively learns shared and differential semantic pathways, balancing similarity aggregation and discrepancy separation to enhance fine-grained discrimination.
• Multi-objective optimization with dynamic weighting. We develop a unified optimization framework integrating weighted classification loss [28,29], soft-label semantic regression loss [30,31], and representation-consistency contrastive loss [32,33]. A dynamic weighting strategy further mitigates optimization bias under long-tailed [34] label distributions.
• Comprehensive experimental validation. Experiments across multiple task scenarios demonstrate that DTGBI-TM consistently outperforms strong baselines in semantic modeling, TTP prediction, and cold-start recognition, while maintaining high deployment efficiency.

2. Related Work

Research on identifying Tactics, Techniques, and Procedures (TTPs) from unstructured cyber-attack descriptions has progressed substantially, giving rise to three major methodological directions: multi-label classification, retrieval-based semantic matching, and pretrained large-language-model (LLM) approaches.

2.1. Classification-Based Methods

Classification-based approaches typically adopt CNNs, BiLSTMs, or fine-tuned BERT models to output TTP probability distributions. Recent studies have further validated the utility of hybrid deep learning architectures (e.g., combining Autoencoders with Gated Recurrent Units) for enhanced cyber threat detection [35]. Representative efforts include TTPDrill [36], which employs an enhanced BM25-weighted TF–IDF [37] scheme for similarity mapping; BERT–BiLSTM–CRF [38] pipelines for extracting threat actions and aligning them with ontologies [39]; and BERT-based variants evaluated across multiple architectural configurations [40]. Despite their simplicity and efficiency, these models often miss behaviors embedded in complex clause structures, degrade under semantic ambiguity, and struggle with emerging or long-tailed TTPs due to the inherent limitations of closed-set multi-label classification.

2.2. Retrieval-Based Methods

Retrieval-based methods encode attack descriptions and TTP definitions into a shared semantic space and perform matching via similarity metrics. RENet [41] improves technique classification using tactic–technique [42] transition matrices; SeqMask [43] extracts behavioral cues for conditional prediction; SATG [44] enables interpretable, evidence-based [45] TTP classification; and ATHRNN [46] incorporates hierarchical dependencies from MITRE ATT&CK. These approaches enhance robustness under semantic ambiguity and provide varying levels of interpretability. However, they still struggle to bridge the semantic gap between free-form attack narratives and standardized TTP definitions, especially when semantic asymmetry is significant.

2.3. LLM-Based Methods

LLM-based methods leverage GPT-, T5-, or instruction-tuned models for direct TTP inference or few-shot prompting. Examples include AECR [47], which uses fine-tuned LLMs [48] for CTI parsing; TTPFShot [49], which employs retrieval-augmented few-shot prompting; and subsequent evaluations demonstrating advantages of retrieval-augmented LLMs in TTP extraction [50,51]. Although these models provide strong generalization and few-shot capability, hallucination, unstable confidence estimation, and high inference cost significantly limit their reliability and deployability in operational cybersecurity environments [52].

3. Task Definition

In cybersecurity, TTP identification aims to extract standardized MITRE ATT&CK labels from unstructured descriptions of attack behaviors. These labels support alert correlation, attack-chain reconstruction, and automated response by providing a unified semantic representation of adversarial actions. Input sources typically include threat intelligence reports, APT analyses, sandbox logs, SIEM alerts, and other heterogeneous textual data with diverse linguistic styles.

Such texts often contain long and complex sentences, implicit cross-sentence dependencies, loosely structured expressions, and substantial linguistic variability. In contrast, MITRE ATT&CK TTP labels define clear semantic granularity and explicit boundary constraints. This disparity between free-form narratives and standardized label definitions creates a fundamental challenge for semantic alignment and structured prediction.

This work formulates TTP identification from unstructured attack descriptions as a semantic matching problem. We denote the attack-description corpus and the standardized TTP label set as

$$\mathcal{X}={\left\{x_i\right\}}_{i=1}^N,\mathcal{Y}={\left\{y_j\right\}}_{j=1}^M$$

(1)

Here, $x_i$ represents the i-th attack-description text, and $y_j$ denotes the j-th standardized TTP label. The goal is to learn a matching function $F(·,·)$ that measures the semantic relevance between a description $x_i$ and a candidate TTP label $y_j$:

$$F:\mathcal{X}\times \mathcal{Y}\to [0,1]$$

(2)

The matching score $F(x_i,y_j)$ quantifies the semantic consistency between the text and the candidate TTP. Based on pairwise relevance scores, we rank the label candidates for each text and select the top-K most relevant labels as the prediction result:

$${\widehat{\mathcal{Y}}}_i=\mathrm{TopK}\left(F(x_i,\mathcal{Y})\right)$$

(3)

This formulation captures the essence of the TTP matching task: learning fine-grained semantic alignment between heterogeneous, unstructured descriptions of adversarial behaviors and a structured, standardized TTP taxonomy.

4. DTGBI-TM Model

Accurately identifying TTP labels hidden within unstructured attack descriptions requires addressing three core challenges: (1) The linguistic style and abstraction level of attack-description texts differ significantly from those of standardized TTP definitions, making direct semantic alignment difficult. (2) Attack descriptions often contain semantic ambiguity and multi-label characteristics, where boundary cases are common and traditional classification models struggle to capture fine-grained relational cues. (3) The TTP taxonomy is inherently open and exhibits long-tailed data distributions, requiring models to generalize to unseen labels while maintaining robustness under label sparsity.

To address these issues, this work proposes a lightweight gated binary interaction model for semantic matching, termed DTGBI-TM. The model integrates soft–hard collaborative supervision, hierarchical hard-negative sampling, and dual-tower gated interaction modeling to enhance semantic representation and improve the adaptability of TTP identification in open and heterogeneous label spaces. DTGBI-TM is designed to extract deep semantic correlations between attack descriptions and TTP labels while retaining sensitivity to nuanced and complex semantic differences.

Figure 1 illustrates the overall architecture of the proposed approach. The pipeline begins by encoding attack-description texts and TTP label definitions into a shared semantic space. A dual-tower encoder produces independent feature representations, followed by a gated binary interaction mechanism that models both shared and differential semantics between the two modalities. This enables fine-grained alignment between free-form text and standardized TTP labels, even when semantic asymmetry is strong.

Furthermore, the model incorporates hierarchical structural information derived from the ATT&CK framework. A tactic-aware and technique-aware hard-negative sampling mechanism is designed to inject domain priors and enhance contrastive difficulty, thereby improving robustness against semantic ambiguity and structural heterogeneity. This sampling strategy increases both intra-tactic discrimination and cross-tactic coverage, contributing to a more effective modeling of long-tailed TTP distributions.

Overall, DTGBI-TM improves semantic resilience and structural diversity by integrating multi-level ATT&CK knowledge, designing tactic-aware and cross-tactic contrastive mechanisms, and constructing adaptive hard-negative samples that enhance differentiation and fine-grained matching capability in complex TTP identification scenarios.

4.1. Soft–Hard Label Supervision Signal Construction

Traditional TTP mapping approaches typically frame the task as a multi-label classification problem, where each input sample is associated with a multi-hot vector indicating the presence (1) or absence (0) of specific TTP labels. However, due to the semantic heterogeneity between unstructured attack descriptions and standardized TTP definitions, determining precise binary assignments is inherently challenging. For example, the sentence “using PowerShell scripts to remotely download files from a server” is more semantically aligned with T1059.001 (PowerShell) and T1105 (Ingress Tool Transfer) than with T1190 (Exploit Public-Facing Application). Such semantic relationships often lie on a continuum rather than adhering to crisp boundaries. Consequently, traditional binary labeling schemes fail to capture the nuanced differences among “strongly related,” “weakly related,” and “irrelevant” labels.

To address this limitation, we propose a semantic soft–hard label supervision mechanism that (i) retains fine-grained associations between input texts and candidate TTP labels, and (ii) smooths label boundaries for cases involving semantic ambiguity. This approach enables the model to better distinguish between semantically adjacent TTP labels and mitigates overfitting caused by inconsistent or imprecise annotations.

To ensure both the consistency and quality of supervision, we developed a rigorous human-in-the-loop (HITL) annotation pipeline involving three senior threat intelligence analysts. The construction process follows three standardized stages: Candidate Generation, Expert Scoring, and Soft-Label Normalization.

4.1.1. Candidate Generation

To reduce the annotation burden associated with exhaustively reviewing the entire label space, we first narrow the search space using a hybrid retrieval strategy. For each input sample $x_i$, a candidate set $S_{\mathrm{cand}}$ is formed by aggregating results from two complementary sources:

• Lexical Retrieval: Top-20 TTPs retrieved via BM25-based keyword matching ($S_{\mathrm{BM}25}$), ensuring high recall for syntactically related labels.
• Semantic Reasoning: Top-5 TTPs generated by an instruction-guided LLM (GPT-3.5) through zero-shot prompting ($S_{\mathrm{LLM}}$), aimed at capturing semantic associations beyond lexical overlap.

This hybrid candidate generation strategy substantially reduces the annotation cost: instead of assessing more than 200 techniques per sample, experts focus only on a compact, high-recall set $S_{\mathrm{cand}}$. Presenting BM25- and LLM-based candidates side by side also allows experts to cross-check lexical and semantic retrieval quality, identify missing but relevant TTPs, and correct occasional noise introduced by either source.

4.1.2. Expert Scoring Protocol

Each unique TTP label $y_j\in S_{\mathrm{cand}}$ is independently evaluated by all three domain experts, who assign a semantic matching score $s_{i,j}\in [0,5]$. This 0–5 scoring scheme is adapted from widely used semantic textual similarity benchmarks (e.g., STS-B [53]), where human annotators rate the degree of semantic relatedness on a bounded ordinal scale. To reduce subjectivity and standardize the process, we established formal scoring criteria as summarized in

Table 1. Expert Semantic Scoring Criteria.

Score	Relevance Level	Definition and Criteria
5	Exact Match	Behavior strictly matches the TTP definition.
4	High Relevance	Shares specific tactics/tools with slight implementation variations.
3	Partial Relevance	Shares general context or keywords but differs in behavior.
1–2	Weak Relation	Only minimal contextual overlap; functionally unrelated.
0	Irrelevant	Completely unrelated in semantics or intent.

.

To ensure label consistency, cases with high inter-annotator variance were flagged for joint review, allowing the experts to resolve ambiguities and finalize a consensus score.

4.1.3. Normalization and Soft Label Generation

The resulting consensus score $s_{i,j}$ is then transformed into a soft label ${\tilde{y}}_{i,j}\in [0,1]$ for regression-based supervision. We adopt the following piecewise mapping to preserve semantic granularity:

$${\tilde{y}}_{i,j}=\left\{\begin{array}{cc}1,\hfill & s_{i,j}\ge 3.5(\mathrm{Strong}\mathrm{Related}),\hfill \\ {\displaystyle \frac{s_{i,j}}{5}},\hfill & 1.5<s_{i,j}<3.5\left(\mathrm{Ambiguous}\right),\hfill \\ 0,\hfill & s_{i,j}\le 1.5(\mathrm{Strong}\mathrm{Related})\hfill \end{array}\right.$$

(4)

In this formulation, scores in the ambiguous region are linearly scaled to reflect subtle semantic gradations as perceived by experts. This design ensures that the regression objective $L_{\mathrm{reg}}$ imposes penalties proportional to the degree of semantic deviation, thereby encouraging more faithful modeling of expert judgments.

This soft–hard supervision framework preserves semantic continuity while still maintaining clear decision boundaries for highly relevant or irrelevant cases. The resulting hybrid labels facilitate both fine-grained representation learning and improved generalization for TTP mapping tasks.

4.2. Hard-Negative Sampling Based on ATT&CK Hierarchical Semantic Priors

The MITRE ATT&CK framework structures cyber-attack behaviors into a two-level hierarchy consisting of Tactics and Techniques, where each tactic represents the adversary’s strategic objective and each technique or sub-technique corresponds to a concrete implementation step. This hierarchical structure encodes rich semantic priors that can guide TTP modeling and enhance label discrimination. To leverage this property, we introduce a hierarchical hard-negative sampling strategy that injects both within-tactic and cross-tactic semantic contrast, improving the quality and diversity of negative samples and thereby strengthening the model’s fine-grained discriminative capability.

4.2.1. ATT&CK Hierarchical Semantics

Let the complete set of TTP labels be defined as

$$\mathcal{Y}=\{y_1,y_2,\dots ,y_k,\dots \}$$

(5)

The 14 high-level tactic categories are denoted as

$$\mathcal{T}=\{t_1,t_2,\dots ,t_k\},k\in \{1,2,\dots ,14\}$$

(6)

The mapping from each technique to its corresponding parent tactic is defined as

$$\varphi :\mathcal{Y}\to \mathcal{T}$$

(7)

This mapping function assigns each technique label $y_j$ to the unique tactic $t_k$ under which it resides. For any positive ground-truth label $y_i^{+}$, the techniques that share the same parent tactic are defined as its sibling techniques. The sibling set is given by

$$B\left(y_i^{+}\right)=\left\{y_{j,k}\in \mathcal{Y}|t_k=\varphi \left(y_i^{+}\right)=\varphi \left(y_{j,k}\right),y_{j,k}\ne y_i^{+}\right\}$$

(8)

Here, $B\left(y_i^{+}\right)$ denotes the set of sibling techniques under the same high-level tactic $t_k$; $y_{j,k}$ denotes an individual sibling technique that shares the same tactic semantics with $y_i^{+}$.

Although sibling techniques are semantically related at the tactic level, they may differ significantly in their technical implementation. For example, the TTP labels T1059.001-PowerShell and T1059.003-VBScript both belong to the “Execution” tactic. While both represent script interpreter execution, their operational mechanisms differ across scripting environments. Thus, techniques that appear tactically similar may still constitute different types of hard-negative samples for the model.

To quantify semantic relationships between labels, we use a MiniLM pretrained language model to encode the definition text of each TTP label and obtain corresponding label embeddings. The semantic similarity between a positive label $y^{+}$ and a negative label $y^{-}$ is measured using the following cosine-style similarity function:

$$\mathrm{sim}(y^{+},y^{-})={\displaystyle \frac{h_{y^{+}}^{\top }{h}_{y^{-}}}{{\parallel h_{y^{+}}\parallel }_2{\parallel h_{y^{-}}\parallel }_2}}$$

(9)

This similarity measure provides the basis for constructing hierarchical hard-negative samples under the ATT&CK framework.

4.2.2. In-Tactic Hard-Negative Sampling

To enhance the model’s ability to distinguish different techniques under the same tactic, we construct a similarity-based Softmax sampling distribution. This distribution incorporates temperature scaling, allowing techniques that are closer to the positive label in semantic space to receive higher sampling probability.

Given an attack-description text and its corresponding positive technique label $y_i^{+}$, let its sibling technique set be $B\left(y_i^{+}\right)$. Using MiniLM to encode the definition texts of TTP labels, we obtain their embedding vectors $h_{y_i^{+}}$ and $h_{y_{j,k}}$. The semantic similarity between $y_i^{+}$ and a sibling technique $y_{j,k}$ is computed as

$$\mathrm{sim}(y_i^{+},y_{j,k})={\displaystyle \frac{h_{y_i^{+}}^{\top }{h}_{y_{j,k}}}{{\parallel h_{y_i^{+}}\parallel }_2{\parallel h_{y_{j,k}}\parallel }_2}}$$

(10)

Within the sibling set $B\left(y_i^{+}\right)$, to automatically select more confusing hard-negative samples, the sampling probability of a sibling technique $y_{j,k}$ is defined as

$$P_{in}(y_{j,k}\mid y_i^{+})={\displaystyle \frac{exp\left(\mathrm{sim}(y_i^{+},y_{j,k})/\tau \right)}{{\displaystyle \sum _{y_s\in B\left(y_i^{+}\right)}}exp\left(\mathrm{sim}(y_i^{+},y_s)/\tau \right)}}$$

(11)

where the temperature parameter $\tau \in (0,1]$ controls the smoothness of the sampling distribution. When $\tau \to 0^{+}$, the distribution approaches a one-hot form, meaning the sibling technique most similar to the positive label is selected. When $\tau \to 1$, the distribution becomes smoother, enabling broader exploration among sibling techniques.

Finally, based on the probability $P_{in}(y_{j,k}\mid y_i^{+})$, a sibling technique $y_{j,k}\in B\left(y_i^{+}\right)$ is sampled to construct the in-tactic hard-negative set ${\mathcal{N}}_{in}$.

4.2.3. Cross-Tactic Hard Negative Sampling

To maintain global semantic stability and mitigate class imbalance, this work introduces a cross-tactic hard negative sampling mechanism at the tactic level. The idea is to draw negative samples from tactics different from that of the given positive label, expanding semantic coverage and preventing the model from overly focusing on locally clustered categories.

For a given positive label $y_i^{+}$ with its tactic defined as $t_{k_1}=\varphi \left(y_i^{+}\right)$, negative samples may be drawn from the set of techniques belonging to tactics $\mathcal{T}\setminus \left\{t_{k_1}\right\}$. We define the average semantic distance between two distinct tactics $t_{k_1}$ and $t_{k_2}$ as

$$d(t_{k_1},t_{k_2})=1-{\displaystyle \frac{1}{\left|Y_{t_{k_1}}\right|\left|Y_{t_{k_2}}\right|}}\sum _{y_a\in Y_{t_{k_1}}}\sum _{y_b\in Y_{t_{k_2}}}\mathrm{sim}(y_a,y_b)$$

(12)

where $Y_{t_{k_1}}$ and $Y_{t_{k_2}}$ denote the sets of TTP technique labels belonging to tactics $t_{k_1}$ and $t_{k_2}$, respectively, and $|·|$ indicates their cardinalities. The function $\mathrm{sim}(·)$ measures the semantic cosine similarity between label embeddings. This distance quantifies the average semantic gap between the two tactics: a larger value indicates greater semantic discrepancy.

Based on the average semantic distance across tactics, $d(t_{k_1},t_{k_2})$ constructs a tactic-level semantic distribution. By computing the average cosine similarity gap for all techniques across tactics, this measure reflects the degree of semantic overlap or separation among tactics. Smaller similarity and larger distance imply stronger semantic divergence.

Given a positive sample $y_i^{+}$ associated with tactic $t_{k_1}$, the probability of selecting a cross-tactic negative sample from tactic $t_{k_2}$ is defined by an inverse-distance Softmax:

$$P_{\mathrm{cross}}(t_{k_2}\mid y_i^{+})={\displaystyle \frac{1/\left(d(t_{k_1},t_{k_2})+ϵ\right)}{{\displaystyle \sum _{t^{\prime }\ne t_{k_1}}}1/\left(d(t_{k_1},t^{\prime })+ϵ\right)}}$$

(13)

where $ϵ$ is set to $1\times {10}^{-5}$ to avoid division by zero.

The sampling distribution $P_{\mathrm{cross}}(t_{k_2}\mid y_i^{+})$ ensures that (1) larger semantic distance $d(t_{k_1},t_{k_2})$ yields a lower sampling probability, indicating that semantically distant tactics contribute less frequently as negative examples; (2) smaller semantic distance yields a higher sampling probability, meaning that more semantically related tactics are preferentially sampled as hard negatives.

This mechanism ensures sufficient cross-tactic negative coverage without deviating from the global semantic space.

After sampling a target tactic $t_{k_2}$ according to $P_{\mathrm{cross}}(t_{k_2}\mid y_i^{+})$, negative labels are then drawn from the technique label set $Y_{t_{k_2}}$, following the intra-tactic sampling distribution $P_{\mathrm{in}}(y_{i,k_2}^{-}\mid y_i^{+})$, forming the final cross-tactic hard negative set $N_{\mathrm{cross}}$.

4.3. Dual-Tower Encoder and Gated Binary Interaction Modeling

Unstructured attack descriptions and standardized TTP labels exhibit substantial semantic asymmetry. The former is linguistically loose, diverse, and easily affected by noise, whereas the latter emphasize conceptual definition and hierarchical structure, with stable abstraction granularity. Directly concatenating and feeding both into a unified encoder tends to blur semantics, introduce noise, and weaken the independence and discrimination capability of the label semantic space.

To address this issue, we propose a dual-tower encoder with gated binary interaction, forming a semantic matching architecture named DTGBI-TM. The model jointly balances semantic comprehension, alignment between similar semantics, and separation of distinct semantics. The overall architecture (Figure 2) consists of three components:

(1)

Dual-tower encoders: independently encode attack descriptions and TTP definitions to ensure semantic consistency within each space;

(2)

Gated binary interaction: model fine-grained semantic similarity and discrepancy through an asymmetric interaction pathway;

(3)

Matching prediction layer: output matching confidence, providing supervision signals for multi-objective optimization.

4.3.1. Dual-Tower Encoding Layer

Given an input attack description $X=\{x_1,x_2,\dots ,x_N\}$ and TTP label definition $Y=\{y_1,y_2,\dots ,y_M\}$, we first use a MiniLM pretrained model to extract contextualized sentence embeddings. Let $h_x,h_y\in {\mathbb{R}}^d$ denote the resulting embeddings:

$$h_x=\mathrm{MiniLM}\left(X\right),h_y=\mathrm{MiniLM}\left(Y\right)$$

(14)

where N and M denote the input sequence lengths, MiniLM represents the pretrained encoder, and d is the embedding dimension.

The dual-tower structure preserves independent encoding for the two inputs, avoiding semantic interference while maintaining shared model parameters to ensure consistent representation spaces. This encoding strategy retains both the contextual richness of attack descriptions and the abstract stability of label semantics, providing disentangled representations for subsequent interaction layers.

4.3.2. Gated Binary Interaction Semantic Representation Layer

To capture deeper semantic relations between attack descriptions and the definitions of TTP labels, this work introduces a gated binary interaction mechanism. The encoded representations are projected onto complementary shared-semantic and differential-semantic channels, enabling an adjustable semantic fusion between shared-mode and boundary-mode representations.

First, let the attack description vector ${\mathbf{h}}_x$ and the TTP label vector ${\mathbf{h}}_y$ serve as the basis units. The binary interaction representation is constructed as

$$\mathbf{i}=\left[{\mathbf{h}}_x\odot {\mathbf{h}}_y;\left|{\mathbf{h}}_x-{\mathbf{h}}_y\right|\right]\in {\mathbb{R}}^{2d}$$

(15)

where ⊙ denotes element-wise multiplication, $\left|·\right|$ denotes element-wise absolute difference, and $[·;·]$ denotes vector concatenation. The term ${\mathbf{h}}_x\odot {\mathbf{h}}_y$ represents the shared-semantic path, used to highlight common semantic activation dimensions of the two vectors; the term $\left|{\mathbf{h}}_x-{\mathbf{h}}_y\right|$ represents the differential-semantic path, emphasizing dimension-wise semantic discrepancies.

Although static concatenation can encode basic similarity and difference signals, it lacks the capability to dynamically balance various semantic relations. Therefore, a gating mechanism is introduced to adaptively control the fusion ratio between the shared-semantic and differential-semantic channels. A learnable d-dimensional gating weight vector is defined as $\mathbf{g}\in {[0,1]}^d$, controlling how the two channels are combined:

$$\mathbf{g}=\sigma \left(W_g\mathbf{i}+{\mathbf{b}}_g\right)$$

(16)

where $W_g\in {\mathbb{R}}^{d\times 2d}$ and ${\mathbf{b}}_g\in {\mathbb{R}}^d$ are trainable parameters, and $\sigma (·)$ is the Sigmoid activation.

The gating weight $\mathbf{g}$ acts as a dynamic control signal, determining the fusion direction in semantic space. Using $\mathbf{g}$ to weight the two channels, the fused semantic representation is computed as

$$\mathbf{f}=\mathbf{g}\odot ({\mathbf{h}}_x\odot {\mathbf{h}}_y)+(1-\mathbf{g})\odot \left|{\mathbf{h}}_x-{\mathbf{h}}_y\right|\in {\mathbb{R}}^d$$

(17)

This representation jointly models semantic consistency and semantic discrepancy. For positive samples, gradient updates encourage larger values in the shared-semantic dimensions ${\mathbf{h}}_x\odot {\mathbf{h}}_y$, reinforcing semantic consistency; for negative samples, gradient updates encourage larger values in the differential dimensions $\left|{\mathbf{h}}_x-{\mathbf{h}}_y\right|$, improving the model’s boundary discrimination capability and enhancing representation separability.

4.3.3. Matching Prediction Layer

Finally, the fused semantic representation $\mathbf{f}$ is projected through a two-layer feedforward network to obtain the matching confidence:

$$p=\sigma \left(W_2·\mathrm{ReLU}(W_1\mathbf{f}+{\mathbf{b}}_1)+{\mathbf{b}}_2\right)\in [0,1]$$

(18)

where $W_1\in {\mathbb{R}}^{d\times d}$, $W_2\in {\mathbb{R}}^{1\times d}$, and ${\mathbf{b}}_1,{\mathbf{b}}_2\in {\mathbb{R}}^{d/2,1}$ are trainable weights and biases. The Sigmoid output p quantifies the matching probability between the attack description and the TTP label and serves as the supervisory signal for multi-objective joint optimization (Section 4.4).

Through the gated interaction mechanism, DTGBI-TM leverages hierarchical priors to achieve dynamic balance between semantic consistency and semantic discrepancy. The model’s semantic space is guided to maintain both sufficient shared semantic activation for positive samples and strengthened differential semantics for negative samples. This provides a solid semantic foundation for the downstream multi-objective optimization process.

4.4. Multi-Objective Joint Optimization Strategy

The multi-objective joint optimization strategy forms the key component of DTGBI-TM training. Robust optimization strategies are essential for deep learning in cybersecurity [54]. In this work, we focus on constraining the decision boundary through loss function design. The model uses the fused semantic representation $\mathbf{f}\in {\mathbb{R}}^d$ and the gating vector $\mathbf{g}$ as the basis for optimization. The objective is to jointly minimize classification loss, maintain smoothness in the semantic space, and enhance the model’s discrimination capability on fine-grained samples.

Specifically, the optimization strategy integrates three complementary objectives: (1) supervision aligned with hard labels, (2) semantic-level regression, and (3) representation consistency regularization. These objectives together shape the unified semantic space by simultaneously enhancing the separability of positive and negative samples and improving robustness in long-tailed or ambiguous cases.

To this end, the model combines multi-level cues—sentence-level semantics, label-level semantics, and cross-sample structural signals—to avoid relying solely on any single semantic granularity, ensuring stable and balanced semantic optimization.

4.4.1. Classification and Semantic Regression Joint Supervision

First, the classification objective $L_{\mathrm{cls}}$ adopts a weighted binary cross-entropy loss to determine the matching relation between an attack description and a TTP label:

$$L_{\mathrm{cls}}=-{\displaystyle \frac{1}{B}}\sum _{b=1}^B{w}_b\left[y_{b}log{p}_b+(1-y_b)log(1-p_b)\right]$$

(19)

where B is the batch size, $y_b$ is the binary hard label of the b-th attack description, $p_b\in [0,1]$ is the matching confidence output from the gated interaction layer, and $w_b$ is a balancing weight.

The explicit supervision ensures that the model learns a clear class decision boundary, allowing weakly correlated samples to remain separable in the semantic space.

To model the continuous nature of semantic similarity between an attack description and a TTP label, a regression objective $L_{\mathrm{reg}}$ based on cosine similarity is introduced:

$$L_{\mathrm{reg}}={\displaystyle \frac{1}{B}}\sum _{b=1}^B{\left(s_b-cos(f_b,h_y)\right)}^2$$

(20)

where $s_b\in [0,1]$ denotes the soft semantic similarity label, and $cos(f_b,h_y)$ is the cosine similarity between the fused representation $f_b$ of the b-th attack description and the label embedding $h_y$.

The regression loss calibrates the model by pulling the prediction closer to the continuous semantic similarity label, enabling the learned representations to preserve semantic continuity.

In summary, the classification objective sharpens decision boundaries, whereas the regression objective smooths the output distribution, jointly promoting both discriminative ability and semantic continuity in the learned space.

4.4.2. Semantic Margin Regularization and Contrastive Learning

To enhance the model’s discriminative capability in the semantic latent space—particularly to reinforce margin constraints for hard negative samples—we introduce a contrastive learning objective based on the InfoNCE principle. The loss is defined as

$$L_{\mathrm{hn}}=-{\displaystyle \frac{1}{B}}\sum _{b=1}^{B}log{\displaystyle \frac{exp\left(cos(f_b,g_b^{+})/\tau \right)}{exp\left(cos(f_b,g_b^{+})/\tau \right)+{\sum }_{g_b^{-}}exp\left(cos(f_b,g_b^{-})/\tau \right)}}$$

(21)

where $\tau$ is a temperature parameter; $cos(·)$ denotes cosine similarity between normalized vectors; $g_b^{+}$ and $g_b^{-}$ represent the gating-weighted positive and negative semantic vectors associated with sample b. This objective pulls the pair $(f_b,g_b^{+})$ closer while pushing $(f_b,g_b^{-})$ apart under a shared normalization framework.

As a result, the dominant direction of $f_b$ becomes aligned with $g_b^{+}$ to strengthen the semantic consistency for positive samples, while negative samples are repelled such that $f_b$ avoids being influenced by false semantic associations encoded in $g_b^{-}$. This induces a clear margin structure in the semantic space.

4.4.3. Dynamic Class Weighting and Joint Optimization Objective

In annotated datasets, TTP labels commonly exhibit a long-tailed distribution, where certain techniques have extremely scarce strong-positive samples. Under conventional training, the model can be biased toward majority classes, making it difficult to capture rare but critical semantics. To address this issue, we introduce a dynamic reweighting strategy that adaptively adjusts class-specific weights based on the ratio of strong-positive versus negative samples within each training batch.

Let the dynamic class weights be defined as

$$w_{\mathrm{pos}}={\displaystyle \frac{N_{\mathrm{neg}}}{N_{\mathrm{pos}}+N_{\mathrm{neg}}}},w_{\mathrm{neg}}={\displaystyle \frac{N_{\mathrm{pos}}}{N_{\mathrm{pos}}+N_{\mathrm{neg}}}}$$

(22)

where $N_{\mathrm{pos}}$ and $N_{\mathrm{neg}}$ denote the numbers of strong-positive and irrelevant samples in the current batch, respectively. The weights $w_{\mathrm{pos}}$ and $w_{\mathrm{neg}}$ correspond to the sample-specific balancing term $w_b$ used in the classification loss.

This strategy constructs an adaptive cost-sensitive learning mechanism that dynamically increases the relative weight of minority classes in the loss function, ensuring that the model does not overlook rare but essential TTP patterns, thereby mitigating bias induced by long-tailed distributions.

Finally, the joint optimization objective of DTGBI-TM is defined as

$$L=L_{\mathrm{cls}}+L_{\mathrm{reg}}+L_{\mathrm{hn}}$$

(23)

where the combined loss integrates classification boundaries, continuous semantic regression, and contrastive margin regularization. We adopt an equal weighting strategy for these terms. Empirically, we observed that since all three objective functions operate on normalized vectors or bounded probability spaces, their magnitudes remain inherently comparable throughout the training process, rendering additional balancing hyperparameters unnecessary. These three objectives complement each other, allowing the model to form hierarchical semantic sensitivity and achieve smoother and more discriminative decision surfaces in high-dimensional semantic space.

4.5. TTP Inference Output Mechanism and Deployment Overhead Analysis

4.5.1. TTP Inference Output Mechanism

After model training is completed, the goal of the inference stage is, for any attack description $x_i\in X$, to predict from the complete TTP label set $\mathcal{Y}$ the subset of labels most semantically relevant to $x_i$, denoted as ${\widehat{\mathcal{Y}}}_i$. The inference process first computes matching confidence scores and then performs thresholding, ranking, and truncation.

For each attack description $x_i$ and any candidate label $y_j\in \mathcal{Y}$, their semantic relatedness is computed by the trained DTGBI–TM model, producing an estimated confidence score ${\widehat{s}}^{(i,j)}\in [0,1]$, which must be converted into a binary relevance prediction. This requires selecting a decision threshold $\theta$. Following prior work, the optimal threshold ${\theta }^{*}$ is determined by maximizing the Micro-F1 score on validation data:

$${\theta }^{*}=arg\underset{0<\theta <1}{max}{F}_{\mathrm{micro}}\left(\theta \right)$$

(24)

With the optimal threshold, the initial binary relevance prediction is

$$I({\widehat{s}}^{(i,j)}\ge {\theta }^{*})=\left\{\begin{array}{cc}1,\hfill & \mathrm{relevant},\hfill \\ 0,\hfill & \mathrm{irrelevant}\hfill \end{array}\right.$$

(25)

Considering that a single attack description may correspond to multiple TTPs, all candidate labels satisfying ${\widehat{s}}^{(i,j)}\ge {\theta }^{*}$ are retained. These labels are then ranked in descending order of their confidence scores, and the top-K labels are selected as the final prediction result.

4.5.2. Model Deployment Overhead Analysis

To evaluate the resource efficiency and deployability of the model, we conduct a parameter and computational complexity analysis based on DTGBI–TM. The encoder is all-MiniLM-L6-v2 with an output embedding dimension of $d=384$. The analysis below focuses on the newly introduced modules above the encoder.

(1)

Parameter Analysis.

DTGBI–TM introduces a gating interaction module and two feed-forward layers on top of the dual-tower encoder. Let the concatenated input to the gating module be $[h_x;h_y]\in {\mathbb{R}}^{2d}$, and let the gating projection matrix be $W_g\in {\mathbb{R}}^{d\times 2d}$ with bias $b_g\in {\mathbb{R}}^d$. The feed-forward layers have weights $W_1\in {\mathbb{R}}^{d_h\times d}$, $W_2\in {\mathbb{R}}^{d\times d_h}$, and bias terms $b_1,b_2$, where $d_h=d/2=192$. Therefore, the total number of additional parameters is

$$\#\mathrm{Param}=2d^2+d+d·d_h+d_h$$

(26)

Substituting $d=384$ yields

$$\#\mathrm{Param}\approx \mathrm{369,216}\approx 3.69\times {10}^5$$

which corresponds to approximately $1.41\times {10}^6$ FP32 bytes or $0.70\times {10}^6$ FP16 bytes. This is significantly smaller than the parameters of the encoder itself (about $22\times {10}^6$), indicating a lightweight add-on module.

(2)

Computational Complexity Analysis.

The total computation of DTGBI–TM consists of the encoding stage and the interaction stage. The model employs a dual-tower design where each input attack sequence x and each label definition y are encoded independently. During inference, label embeddings can be pre-computed and cached offline. Thus, each online query only requires encoding x once. The encoding complexity is

$$O(L_x·H·L_{\mathrm{enc}})$$

(27)

where $L_x$ is the input sequence length, H is the hidden dimension, and $L_{\mathrm{enc}}$ is the number of Transformer layers.

After encoding, the system must compute interaction features between x and candidate labels. Let the number of candidate labels be M, with each label embedding dimension d. The interaction module includes element-wise operations and feed-forward computations:

$$O(2d^2+d·d_h)$$

(28)

with $d_h=d/2$. Therefore, the total interaction complexity for all M candidates is

$$O\left(M(2d^2+d·d_h)\right)\approx O(M·d^2)$$

(29)

During training, DTGBI–TM introduces hierarchical hard-negative sampling. Given cached label embeddings, the computational cost of negative sampling is dominated by similarity computation and weighting:

$$O\left(\left(\right|B\left(y\right)|+|\mathcal{T}\left|\right)·d\right)$$

(30)

where $\left|B\right(y\left)\right|$ denotes the size of the sibling technique set and $\left|\mathcal{T}\right|$ denotes the number of tactic groups. This overhead is relatively small because the model primarily samples a constant number of negatives per step.

Overall, the total complexity of DTGBI–TM is

$$O(L_x·H·L_{\mathrm{enc}})+O(M·d^2)$$

(31)

By contrast, a Cross-Encoder concatenates inputs into a sequence of length $L=L_x+L_y$ and performs self-attention in each Transformer layer with cost:

$$O(L^2·H·L_{\mathrm{enc}})$$

(32)

which must be recomputed for every candidate label and cannot reuse intermediate representations. As L grows, this incurs quadratic scaling and significantly slows inference. In contrast, DTGBI–TM benefits from a decoupled architecture that caches label embeddings offline and performs efficient vector interaction online, improving deployability and offering clear advantages in scenarios with large candidate label sets or long label-definition sequences.

5. Experimental Results

This section presents comprehensive experiments on semantic alignment and TTP prediction, which are the two core tasks of the proposed DTGBI-TM model. For semantic alignment, the model enhances the consistency between matched samples in the semantic space by enlarging the inter-class margin and tightening the intra-class compactness. For TTP prediction, the model aims to identify the correct technique labels associated with an attack description. We conduct detailed evaluations on both tasks across multiple representative baselines. Furthermore, we introduce an additional cross-domain generalization experiment based on the TRAM benchmark to verify the robustness of the model in realistic heterogeneous intelligence scenarios.

We report precision, recall, and the F1 score as the primary evaluation metrics. The semantic-matching baselines include TF-IDF, BM25/TTPDrill, SecureBERT-based matching, and TPTHunter. For fine-grained similarity analysis, we further include Sentence-BERT and recent LLM-based reasoning methods (e.g., TPTHunter-X). These models help assess the ability to distinguish between semantically close yet label-divergent samples. We then compare the proposed DTGBI-TM with these methods to validate its effectiveness in both semantic alignment and technique prediction.

5.1. Datasets and Evaluation Metrics

5.1.1. Datasets

The primary dataset used in the experiments is constructed from publicly available threat intelligence reports, APT analytical bulletins, and email-behavior logs. After manual verification, we follow the “soft label annotation protocol” to obtain sample pairs consisting of attack descriptions and their corresponding TTP definitions. The resulting dataset contains 9760 samples, which are split into training and testing subsets with an 8:2 ratio based on the soft-label score distribution. Specifically, 7808 samples are used for training and 1592 for testing, covering a total of 278 TTP labels.

The soft-label scores primarily concentrate around boundary regions, reflecting the continuous semantic relatedness between attack descriptions and TTP labels. We adopt 5-fold cross-validation on the training set and report the best-performing results on the validation folds.

Table 2. Distribution of Soft-Label Intervals in the Main Dataset (%).

Interval	Full Set	Training Set	Test Set
[5, 4)	43.8	43.8	43.8
[4, 3)	34.4	34.4	34.3
[3, 2)	15.9	15.9	16.0
[2, 1)	5.1	5.1	5.0
[1, 0]	0.9	0.9	0.9

further shows the data distribution across different soft-label intervals.

To evaluate out-of-distribution generalization under cross-domain settings, we employ the TRAM (Threat Report ATT&CK Mapper) dataset as a migration-testing benchmark. TRAM is curated by MITRE’s threat intelligence team and is one of the most widely used public datasets for attack-technique identification. Its original annotation scheme is based on simplified ATT&CK indexing, resulting in a large number of semi-structured samples with incomplete context or missing relational information.

Crucially, TRAM provides only discrete binary hard labels and lacks the fine-grained continuous semantic scores required for the soft-label regression objective ($L_{\mathrm{reg}}$) central to our framework. This limitation makes it unsuitable for the training phase of DTGBI-TM, which relies on soft supervision to capture boundary semantics. Consequently, we reserve TRAM exclusively for testing, using it to emulate real-world domain-shift scenarios and examine the model’s robustness in handling noisy or weakly structured attack descriptions.

Table 3. Statistical Characteristics of the Datasets.

Dataset	Split	#Samples	Avg. Token	Max Token	Boundary (%)	#TTP	Avg. Labels
	Full Set	9760	90.5	255	23.4	278	35.2
Main Dataset	Training Set	7808	90.4	255	23.4	274	28.4
	Test Set	1592	91.2	255	23.5	193	10.2
TRAM	–	4797	23	255	–	270	13.2

summarizes the general statistics of both the primary dataset and the TRAM dataset. To provide a more detailed view of the class distribution within the private dataset, Figure 3 illustrates the exact sample counts for the top-20 TTP labels. The visualization reveals a significant long-tailed distribution, where high-frequency techniques (e.g., T1059.001 PowerShell) dominate, while the prevalence of subsequent classes decays rapidly. This characteristic highlights the necessity of the proposed dynamic class weighting and hard-negative sampling mechanisms to handle label imbalance effectively.

5.1.2. Evaluation Metrics

Both the semantic modeling optimization task and the TTP prediction task are evaluated using Micro-averaged Precision, Recall, and F1-score, which are widely adopted for performance assessment under imbalanced multi-label classification settings. For deployment evaluation, we additionally report model parameter size, inference latency, and GPU memory consumption.

5.2. Baselines and Experimental Configuration

5.2.1. Baseline Implementations

To thoroughly assess the effectiveness of the proposed DTGBI-TM model, we compare it against representative baselines covering four categories: sparse retrieval, deep-learning-based classification, semantic matching, and LLM-based prompt learning. The baselines and their implementation details are as follows:

(1)

Sparse Retrieval Methods.

• TF-IDF. Constructs bag-of-words representations using term frequency and inverse document frequency, and computes similarity via cosine similarity.
• BM25 (TTPDrill). A probabilistic retrieval algorithm that jointly accounts for term frequency and document length. BM25 is adopted by the TTPDrill system as its core mapping module.

(2)

Deep-Learning-Based Multi-Class Classification.

• SecureBERT + Classifier (TTPHunter). TTPHunter leverages SecureBERT—pre-trained on cybersecurity corpora—to extract textual features, which are then fed into a classification layer for multi-class TTP prediction.
• SecureBERT_DTGBI-TM + Classifier. Based on SecureBERT, this model integrates the proposed soft–hard label joint supervision mechanism, gated bi-interaction semantic feature modeling, and multi-objective loss optimization. These enhancements improve robustness and discriminative ability before the final classification layer.

(3)

Semantic Matching.

• Sentence-BERT. A dual-tower architecture that computes semantic similarity through cosine similarity between encoded sentence embeddings.

(4)

LLM-Based Prompt Learning.

• LLM (TTPXHunter). TTPXHunter follows a few-shot, prompt-based inference strategy. The input combines the attack description with carefully designed TTP-guided prompt templates, enabling large language models to generate TTP predictions directly. We implemented a few-shot, prompt-based inference strategy consistent with recent works like TTPXHunter. The input combines the attack description with carefully designed TTP-guided system instructions and demonstrative examples, enabling the model to generate predictions via in-context learning. Specifically, we employed Llama3-70B (via 4-bit quantization) as the execution engine for this baseline. It is important to clarify the model roles: while GPT-3.5 was utilized solely for auxiliary candidate generation during data construction (Section 4.1), Llama3-70B serves as the primary baseline for experimental accuracy comparison. The specific few-shot prompt template used is detailed in Appendix A.

5.2.2. DTGBI-TM Inference Settings

For the proposed DTGBI-TM model, the decision threshold $\theta$ is determined using 5-fold cross-validation on the training set by maximizing the Micro-F1 score. This optimal threshold is then fixed during evaluation on the test set.

All input sequences are truncated or padded to a maximum length of 255 tokens. Sparse-retrieval baselines perform matching over the complete TTP label repository, while LLM-based baselines adopt the original prompt templates defined in TTPXHunter. These unified settings ensure the fairness and reproducibility of cross-model comparisons.

5.3. Experimental Setup

The experimental environment and key hyperparameter settings are summarized in

Table 4. Experimental Deployment Configuration. Unit: %.

Component	Configuration
Operating System	Ubuntu 20.04
Programming Language	Python 3.8
Deep Learning Framework	PyTorch 1.9.0
GPU	NVIDIA RTX 3090 (24 GB)
Pretrained Models	MiniLM, BERT-base
Batch Size	{8, 16, 32}
Learning Rate	{2 × 10−5, 3 × 10−5, 5 × 10−5}
Epochs	12
Dropout Rate	{0.1, 0.2, 0.3}
Optimizer	AdamW
InfoNCE Temperature ${\tau }_{\mathrm{nce}}$	{0.05, 0.07, 0.1}
Hard-Negative Temperature $\tau$	{0.1, 0.3, 0.5, 0.7, 1.0}

Note: Bold values denote the final selected hyperparameters.

. Following common practices in task-specific and domain-adapted modeling, we perform a systematic hyperparameter search to ensure fair and optimized configurations.

The backbone encoders include MiniLM and BERT-base, selected for their balance between representational capacity and computational efficiency. The optimizer is set to AdamW to leverage its stability under Transformer-based architectures. Based on preliminary validation, the maximum number of training epochs is fixed to 12.

For sensitivity analysis, learning rate, batch size, and dropout rate are tuned via small-scale grid search. The temperature parameter ${\tau }_{\mathrm{nce}}$ for the InfoNCE loss is selected from the typical range used in representation-learning literature (e.g., SBERT/Siamese-BERT), i.e., $\{0.05,0.07,0.1\}$. The temperature $\tau$ for hard negative sampling is tuned within $\{0.1,0.3,0.5,0.7,1.0\}$. Final configurations are chosen based on validation performance and used consistently across all subsequent experiments to ensure reproducibility.

To further analyze the behavior of the hard-negative sampling strategy inspired by ATT&CK hierarchical semantics, we examine how the sampling temperature $\tau$ influences model performance. The temperature controls the sharpness of the semantic similarity distribution when selecting hard negatives—lower $\tau$ concentrates the distribution, whereas higher $\tau$ yields smoother weighting.

As shown in Figure 4, when $\tau \to 0.1$, the F1 score is relatively low, likely due to overly concentrated sampling that forces the model to focus on a small number of extreme hard negatives and thus destabilizes optimization. As $\tau$ increases to $0.5$, performance steadily improves. Further increasing $\tau$ to $1.0$ leads to a slight performance drop, indicating that sampling becomes overly smooth and unable to properly emphasize challenging negatives.

Overall, $\tau =0.5$ achieves the best balance and is adopted as the fixed setting in all later experiments to ensure stable performance and reproducibility.

5.4. Experiments and Result Analysis

This section provides a comprehensive evaluation of the proposed DTGBI-TM model across multiple TTP-related tasks. We assess the model from four perspectives: (1) semantic representation learning; (2) TTP classification under both soft- and hard-label supervision; (3) cold-start generalization; (4) ablation analysis and efficiency evaluation. All metrics are reported in percentage form with two decimal places retained for clarity.

5.4.1. Semantic Representation Learning

This task measures the ability of DTGBI-TM to learn discriminative and boundary-aware representations of attack descriptions and TTP labels. We compare our method with representative baselines, including sparse retrieval (TF-IDF, BM25/TTPDrill), deep-learning classifiers (SecureBERT_DTGBI-TM, SecureBERT + Classifier), and semantic matching models (Sentence-BERT).

Table 5. Semantic Representation Performance Comparison. Unit: %.

Model	Precision	Recall	F1
DTGBI-TM	98.36	98.70	98.53
SecureBERTDTGBI-TM	98.03	96.40	97.21
Sentence-BERT	95.41	94.59	95.00
TF-IDF	96.30	3.13	6.07
BM25/TTPDrill	93.68	75.06	83.34

summarizes the results.

The proposed DTGBI-TM model achieves the best performance across all three core metrics, reaching an F1 score of 98.53%. Compared with Sentence-BERT, DTGBI-TM improves the F1 score by 3.53 percentage points, and surpasses BM25 by 15.19 points. Although SecureBERT_DTGBI-TM also benefits from our optimization strategies, its large parameter scale (∼110 M) leads to substantial inference cost, significantly reducing its deployment feasibility in resource-constrained environments. By contrast, DTGBI-TM (parameter size ∼22 M) achieves competitive accuracy while substantially improving deployment efficiency, particularly for edge devices and latency-sensitive systems.

5.4.2. TTP Prediction Task

This subsection evaluates the capability of each model to accurately predict TTP labels under a fully supervised setting, where the complete label space is available during testing. To ensure fair comparison, we adopt the same baselines used in the semantic modeling task and compute Precision, Recall, and F1 under the Top-1 prediction setting for each attack description. This evaluation setting emphasizes the model’s ability to identify the single most relevant TTP label and reflects its practical utility in automated TTP detection.

The performance comparison results are summarized in

Table 6. TTP Prediction Performance Comparison. Unit: %.

Model	Precision	Recall	F1
DTGBI-TM	79.06	80.49	79.77
Sentence-BERT	75.14	74.63	73.89
BM25	73.48	52.49	57.88
TF-IDF	41.87	43.22	37.53
SecureBERT	71.82	60.71	64.73
SecureBERTDTGBI-TM + Classifier	76.73	70.32	72.11
LLM	73.62	76.40	73.79

. Under the Top-1 metric, DTGBI-TM achieves the highest F1 score of 79.77%, outperforming Sentence-BERT by 3.74 percentage points and surpassing LLM-based prediction by 5.9 points. These results demonstrate that the proposed semantic matching framework—incorporating hybrid supervision and multi-level interaction modeling—offers superior discriminative capability for TTP prediction.

Compared with traditional multi-class classification models, DTGBI-TM demonstrates stronger robustness when predicting labels within a large and semantically diverse TTP space. Although LLM-based methods exhibit strong linguistic understanding, their reliance on generative reasoning results in unstable confidence and weaker Top-1 accuracy. Thus, DTGBI-TM remains the most practical and reliable choice for TTP prediction.

5.4.3. Unseen-Label Generalization

To systematically evaluate the robustness of DTGBI-TM under open-label conditions and heterogeneous linguistic environments, we design two groups of unseen-label generalization experiments. These experiments assess: (1) the model’s ability to handle newly emerging TTP labels; and (2) its capability to transfer across domains with significant data-distribution shifts. Both the main dataset and the TRAM dataset are used for comprehensive analysis.

First, to assess the model’s ability to process completelyunseen TTP labels, we randomly select 20% of the labels in the main dataset and designate them as “cold-start” labels. These labels do not appear during training, ensuring that the model has no prior exposure to them and must infer their semantics solely based on textual descriptions in the testing phase. This setup better reflects real-world open-label environments in which new attack techniques continuously emerge.

The resulting test set contains 384 samples distributed across 56 unseen labels, with approximately five samples per label. Unlike closed-set classification, the model must match the semantic representations of attack descriptions to candidate labels through similarity computation.

Table 7. Performance Comparison on Unseen TTP Labels (Main Dataset). Unit: %.

Model	Precision	Recall	F1
DTGBI-TM	56.12	62.80	59.27
Sentence-BERT	50.42	55.37	52.80
BM25	33.11	35.44	34.22
TF-IDF	20.29	21.62	20.94
SecureBERT + Classifier	42.34	46.12	44.14
SecureBERTDTGBI-TM + Classifier	49.03	52.37	50.63
LLM	40.21	52.10	45.49

reports the Top-1 prediction performance on the main dataset under unseen-label conditions.

Under this cold-start setting, DTGBI-TM achieves an F1 score of 59.27%, outperforming the best multi-class baseline by 8.44 percentage points, and surpassing LLM-based prompting methods by 13.88 percentage points. These results demonstrate that DTGBI-TM effectively models semantic discrepancies across labels and generalizes well to novel semantics. Its superiority can be attributed to three factors: (1) the binary-interaction representation provides finer-grained modeling of semantic relations between attack descriptions and candidate labels; (2) the integration of soft-label alignment and hard-label contrastive constraints enhances robustness against label noise and distribution mismatches; (3) unified multi-objective optimization yields more stable embeddings and mitigates overfitting to seen labels.

To further evaluate generalization under domain-shift conditions, we adopt the TRAM dataset as an out-of-distribution (OOD) test set. As shown in

Table 8. Performance Comparison on Unseen Samples (TRAM Dataset). Unit: %.

Model	Precision	Recall	F1
DTGBI-TM	45.50	49.14	47.25
Sentence-BERT	37.86	42.35	39.98
BM25	36.09	31.00	32.77
TF-IDF	19.35	23.18	20.87
SecureBERT + Classifier	41.73	49.32	44.82
SecureBERTDTGBI-TM + Classifier	40.66	42.20	41.42
LLM	39.82	49.11	43.98

, DTGBI-TM achieves an F1 score of 47.25%, exceeding the best multi-class baseline by 4.44 percentage points and outperforming Sentence-BERT and LLM-based prompting models. These results confirm the model’s enhanced resilience to domain variations and its ability to generalize across heterogeneous CTI corpora. In contrast, traditional sparse retrieval models (BM25 and TF-IDF) show limited adaptability due to insufficient semantic modeling capacity.

5.4.4. Ablation Study

To further validate the contribution of each component within the DTGBI-TM framework to overall semantic modeling performance, we conduct an ablation study by removing four core mechanisms: soft-label supervision, ATT&CK-guided hard-negative sampling, the gated bi-interaction semantic module, and the multi-objective joint loss optimization. Experimental results are presented in

Table 9. Ablation Study Results. Unit: %.

Configuration	Precision	Recall	F1 Score
DTGBI-TM (Full Model)	98.36	98.70	98.53
w/o Soft-Label Supervision	97.34	93.32	95.27
w/o ATT&CK Hard-Negative Sampling	97.43	95.78	96.59
w/o Gated Bi-Interaction Module	96.85	96.03	96.43
w/o Multi-Objective Loss Optimization	96.21	94.95	95.57

.

The complete DTGBI-TM model achieves the highest performance, with Precision = 98.36%, Recall = 98.70%, and F1 = 98.53%, maintaining strong consistency across all three metrics. Removing soft-label supervision substantially decreases Recall (from 98.70% to 93.32%) and reduces F1 by 3.26 percentage points, indicating that soft-label signals effectively guide the model toward boundary-aware semantic representations.

Similarly, eliminating ATT&CK-informed hard-negative sampling yields a notable decline of 2.92 percentage points in Recall, reflecting the importance of semantically structured hard negatives in enforcing fine-grained separability across confusing TTP labels. Without the gated bi-interaction module, performance decreases by 2.10 percentage points in F1, demonstrating that this module captures cross-level semantic dependencies essential for consistent representation.

Finally, removing the multi-objective loss optimization leads to a noticeable drop in all metrics, showing that combining classification, semantic regression, and contrastive learning objectives strengthens representation smoothness and improves label consistency. Overall, the results confirm that each module plays a critical and complementary role, and jointly they contribute to the performance and robustness of DTGBI-TM.

5.5. Deployment Overhead and Efficiency Evaluation

To assess the deployability of the DTGBI-TM model in engineering scenarios, this section evaluates both computational efficiency and resource consumption. We focus on two aspects: (1) the sampling overhead introduced by the ATT&CK prior–driven hierarchical negative sampling mechanism, which reflects the computational cost during training; (2) the inference-phase efficiency and memory footprint, which indicate the practicality of real-world deployment.

5.5.1. Negative Sampling Efficiency Based on ATT&CK Hierarchical Semantics

All experiments are conducted on an NVIDIA RTX 3090 GPU (24 GB memory) using the FP16 precision mode provided by PyTorch 1.9. The batch size is set to 16. In each training iteration, the model samples one positive example and eight hierarchical negative examples following the ATT&CK prior.

Table 10. Negative Sampling Efficiency.

Sampling Type	Avg. Time per Step (ms)	Proportion (%)
Intra-domain negative sampling	0.18	28
Cross-domain negative sampling	0.47	72
Total	0.65	100

summarizes the sampling efficiency.

It indicates that for every 1000 training steps, semantic similarity computation accounts for approximately 0.18 ms/step, whereas cross-domain negative sampling requires 0.47 ms/step, leading to an overall sampling overhead of roughly 0.65 ms/step. This constitutes only 5.3% of the total per-step computation time of DTGBI-TM, showing that the proposed hierarchical negative sampling mechanism imposes negligible overhead while effectively preserving the semantic diversity of negative examples.

5.5.2. Model Size and Deployment Cost Analysis

We further compare DTGBI-TM with representative baselines (including Sentence-BERT, SecureBERT, and large LLMs such as Llama3-70B) under identical hardware settings. The efficiency evaluation results are summarized in

Table 11. Efficiency Evaluation Results. For the Llama3-70B, the reported memory represents the per-GPU peak usage in a dual-GPU distributed setup with 4-bit quantization, whereas DTGBI-TM requires only a single GPU.

Model	Parameters (×106)	Avg. Inference Latency (ms)	Memory (GB)
DTGBI-TM	22.7	12.3	1.2
Sentence-BERT	22.0	11.9	1.4
SecureBERT + Classifier	110.0	16.7	5.2
LLM (e.g., Llama3-70B)	70,000	≫100	24

. Sentence-BERT (all-MiniLM-L6-v2 backbone) and SecureBERT (BERT-base backbone) require significantly larger memory and higher computational cost during inference.

We evaluate each model by processing 256 test samples in batch inference for 100 iterations. Results show that DTGBI-TM, owing to its lightweight architecture, requires only 1.2 GB of GPU memory—substantially lower than SecureBERT and LLM baselines. We recognize that comparing our fine-tuned, task-specific model (DTGBI-TM) with a few-shot general-purpose LLM is not a strictly like-for-like architectural comparison. Nevertheless, this setting is informative in practice, as it highlights the efficiency–accuracy trade-off: in our experiments, a domain-optimized lightweight model (∼22 M parameters) can outperform a much larger general-purpose model (∼70 B parameters) on specialized TTP mapping, suggesting its suitability for resource-constrained deployment scenarios. In addition, the inference latency is reduced by more than 50%, demonstrating its strong deployability in edge environments or large-scale online TTP prediction systems.

Overall, DTGBI-TM achieves an excellent balance between training efficiency, inference latency, and memory usage. The model’s lightweight architecture and hierarchical negative sampling mechanism significantly reduce training cost while maintaining strong accuracy, making DTGBI-TM well-suited for deployment in resource-constrained threat intelligence matching and TTP inference systems.

6. Conclusions

This paper presents a TTP identification framework that integrates soft-label supervision, gated bi-interaction semantic modeling, and multi-objective joint optimization. The method is designed to address several key challenges in threat-technique prediction, including non-standardized attack descriptions, long-tailed label distributions, and blurred semantic boundaries. To this end, we construct a structure-aligned dataset and introduce interaction features together with consistency regularization, enabling the model to achieve stronger generalization on both boundary cases and unseen samples. Experiments across multiple subtasks validate the effectiveness and deployment potential of the proposed approach. Future work will further explore label-structure modeling and semantic relation modeling among multiple TTP labels, with the goal of enhancing model expressiveness in complex cyber-defense scenarios.