{"id":"https://openalex.org/W7152749432","doi":"https://doi.org/10.1109/tkde.2026.3682468","title":"Toward Zero-Shot Multi-Label Identification of Attack Techniques: Enhancing LLM Reasoning With Semantic Evidence Discovery","display_name":"Toward Zero-Shot Multi-Label Identification of Attack Techniques: Enhancing LLM Reasoning With Semantic Evidence Discovery","publication_year":2026,"publication_date":"2026-04-09","ids":{"openalex":"https://openalex.org/W7152749432","doi":"https://doi.org/10.1109/tkde.2026.3682468"},"language":null,"primary_location":{"id":"doi:10.1109/tkde.2026.3682468","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tkde.2026.3682468","pdf_url":null,"source":{"id":"https://openalex.org/S30698027","display_name":"IEEE Transactions on Knowledge and Data Engineering","issn_l":"1041-4347","issn":["1041-4347","1558-2191","2326-3865"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Knowledge and Data Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133238313","display_name":"Ziyu Wang","orcid":"https://orcid.org/0009-0005-5494-1513"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ziyu Wang","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security and Huangpu Research School, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0005-5494-1513","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security and Huangpu Research School, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133291494","display_name":"Zhanhao Fan","orcid":null},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhanhao Fan","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security and Huangpu Research School, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0007-1835-3946","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security and Huangpu Research School, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130253726","display_name":"Yanjun Li","orcid":null},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanjun Li","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security and Huangpu Research School, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0004-8212-9031","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security and Huangpu Research School, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133257899","display_name":"Xing Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I4210087349","display_name":"China Resources (China)","ror":"https://ror.org/0026yhs27","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210087349"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xing Zhang","raw_affiliation_strings":["China Resources Digital Company, Ltd., Shenzhen, China"],"raw_orcid":"https://orcid.org/0009-0006-7911-4191","affiliations":[{"raw_affiliation_string":"China Resources Digital Company, Ltd., Shenzhen, China","institution_ids":["https://openalex.org/I4210087349"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133286183","display_name":"Peng Dai","orcid":null},"institutions":[{"id":"https://openalex.org/I4210089559","display_name":"Shenzhen Metro (China)","ror":"https://ror.org/008hpge95","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210089559"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Peng Dai","raw_affiliation_strings":["Shenzhen Branch of China United Network Communication Company, Ltd., Shenzhen, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shenzhen Branch of China United Network Communication Company, Ltd., Shenzhen, China","institution_ids":["https://openalex.org/I4210089559"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5133294163","display_name":"Zhihong Tian","orcid":"https://orcid.org/0000-0002-9409-5359"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhihong Tian","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security and Huangpu Research School, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-9409-5359","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangdong Key Laboratory of Industrial Control System Security and Huangpu Research School, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.40316521,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"38","issue":"7","first_page":"4791","last_page":"4804"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.33730000257492065,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.33730000257492065,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12262","display_name":"Hate Speech and Cyberbullying Detection","score":0.12189999967813492,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.09430000185966492,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.6029999852180481},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.43799999356269836},{"id":"https://openalex.org/keywords/knowledge-based-systems","display_name":"Knowledge-based systems","score":0.31279999017715454},{"id":"https://openalex.org/keywords/knowledge-representation-and-reasoning","display_name":"Knowledge representation and reasoning","score":0.3003000020980835},{"id":"https://openalex.org/keywords/intelligence-analysis","display_name":"Intelligence analysis","score":0.2854999899864197},{"id":"https://openalex.org/keywords/ontology","display_name":"Ontology","score":0.2831000089645386},{"id":"https://openalex.org/keywords/description-logic","display_name":"Description logic","score":0.27799999713897705}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8478000164031982},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.6029999852180481},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.46860000491142273},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.43799999356269836},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.40380001068115234},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.3158999979496002},{"id":"https://openalex.org/C115925183","wikidata":"https://www.wikidata.org/wiki/Q1412694","display_name":"Knowledge-based systems","level":2,"score":0.31279999017715454},{"id":"https://openalex.org/C161301231","wikidata":"https://www.wikidata.org/wiki/Q3478658","display_name":"Knowledge representation and reasoning","level":2,"score":0.3003000020980835},{"id":"https://openalex.org/C517642484","wikidata":"https://www.wikidata.org/wiki/Q2388514","display_name":"Intelligence analysis","level":2,"score":0.2854999899864197},{"id":"https://openalex.org/C25810664","wikidata":"https://www.wikidata.org/wiki/Q44325","display_name":"Ontology","level":2,"score":0.2831000089645386},{"id":"https://openalex.org/C102993220","wikidata":"https://www.wikidata.org/wiki/Q387196","display_name":"Description logic","level":2,"score":0.27799999713897705},{"id":"https://openalex.org/C195344581","wikidata":"https://www.wikidata.org/wiki/Q2555318","display_name":"Automated reasoning","level":2,"score":0.2768999934196472},{"id":"https://openalex.org/C20162079","wikidata":"https://www.wikidata.org/wiki/Q1151406","display_name":"Case-based reasoning","level":2,"score":0.2759000062942505},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.271699994802475},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2671999931335449},{"id":"https://openalex.org/C120567893","wikidata":"https://www.wikidata.org/wiki/Q1582085","display_name":"Knowledge extraction","level":2,"score":0.26429998874664307},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.26170000433921814}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tkde.2026.3682468","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tkde.2026.3682468","pdf_url":null,"source":{"id":"https://openalex.org/S30698027","display_name":"IEEE Transactions on Knowledge and Data Engineering","issn_l":"1041-4347","issn":["1041-4347","1558-2191","2326-3865"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Knowledge and Data Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Reduced inequalities","id":"https://metadata.un.org/sdg/10","score":0.4748604893684387}],"awards":[{"id":"https://openalex.org/G6064493666","display_name":null,"funder_award_id":"U2436208","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8812891240","display_name":null,"funder_award_id":"62372129","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":46,"referenced_works":["https://openalex.org/W2075357005","https://openalex.org/W2120929742","https://openalex.org/W2137733632","https://openalex.org/W2140229565","https://openalex.org/W2771963642","https://openalex.org/W2804344463","https://openalex.org/W2908909372","https://openalex.org/W2910453440","https://openalex.org/W2913350960","https://openalex.org/W2948947170","https://openalex.org/W2970641574","https://openalex.org/W3155895380","https://openalex.org/W3170276438","https://openalex.org/W3211888892","https://openalex.org/W4245019076","https://openalex.org/W4286375281","https://openalex.org/W4289533971","https://openalex.org/W4289646353","https://openalex.org/W4312995921","https://openalex.org/W4319079731","https://openalex.org/W4319863510","https://openalex.org/W4324031781","https://openalex.org/W4385270681","https://openalex.org/W4385289243","https://openalex.org/W4387298166","https://openalex.org/W4389523765","https://openalex.org/W4390881876","https://openalex.org/W4392947753","https://openalex.org/W4399039481","https://openalex.org/W4400121705","https://openalex.org/W4400586487","https://openalex.org/W4400910477","https://openalex.org/W4402212783","https://openalex.org/W4402352837","https://openalex.org/W4402622967","https://openalex.org/W4403343675","https://openalex.org/W4404555905","https://openalex.org/W4404731747","https://openalex.org/W4408566170","https://openalex.org/W4409659448","https://openalex.org/W4411451780","https://openalex.org/W4412887902","https://openalex.org/W4413349545","https://openalex.org/W4414165892","https://openalex.org/W4414281281","https://openalex.org/W7126385092"],"related_works":[],"abstract_inverted_index":{"Accurately":[0],"mapping":[1],"unstructured":[2],"cyber":[3],"threat":[4],"intelligence":[5],"(CTI)":[6],"text":[7,83],"to":[8,47,119],"standardized":[9],"attack":[10],"technique":[11,70,134],"remains":[12],"a":[13,74],"fundamental":[14],"yet":[15],"challenging":[16],"task,":[17],"especially":[18],"under":[19],"zero-shot":[20,171],"conditions":[21,129],"where":[22],"no":[23],"labeled":[24],"instances":[25],"from":[26],"the":[27],"target":[28],"CTI":[29,161],"corpus":[30],"are":[31],"available.":[32],"Existing":[33],"methods":[34],"largely":[35],"rely":[36],"on":[37,130,153,158],"heuristic":[38],"rules":[39],"or":[40,50],"supervised":[41,143],"classifiers,and":[42],"therefore":[43],"often":[44],"generalize":[45],"poorly":[46],"unseen,":[48],"long-tail,":[49],"evolving":[51],"techniques.":[52],"To":[53],"overcome":[54],"these":[55],"limitations,":[56],"we":[57],"propose":[58],"<italic":[59,76],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[60,77,189],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">RA-CTI</i>\u2014a":[61],"retrieval-augmented":[62],"Large":[63],"Language":[64],"Model":[65],"(LLM)":[66],"framework":[67],"for":[68,80,109,136],"contextual":[69],"identification,":[71,173],"which":[72],"instantiates":[73],"general":[75],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">Retrieve\u2013Expand\u2013Infer</i>":[78],"paradigm":[79],"aligning":[81],"free-form":[82],"with":[84],"ontology-driven":[85],"label":[86],"inventories.":[87],"RA-CTI":[88,165],"reformulates":[89],"MITRE":[90,132],"ATT&CK":[91,133],"Techniques":[92],"Identification":[93],"as":[94],"semantic":[95,107,138],"evidence":[96,117],"discovery":[97],"and":[98,116,122,124,178],"reference-guided":[99],"reasoning":[100],"through":[101],"three":[102],"coordinated":[103],"stages:":[104],"(1)":[105],"dense":[106],"retrieval":[108],"efficient":[110],"candidate":[111],"acquisition,":[112],"(2)":[113],"query":[114],"expansion":[115],"aggregation":[118],"improve":[120],"recall":[121],"coverage,":[123],"(3)":[125],"reference-aware":[126],"inference":[127],"that":[128,164],"explicit":[131],"definitions":[135],"fine-grained":[137],"alignment.":[139],"An":[140],"optional":[141],"weakly":[142],"retriever":[144],"adaptation":[145],"module":[146],"further":[147],"improves":[148],"domain":[149],"robustness":[150],"without":[151],"relying":[152],"manual":[154],"annotations.":[155],"Extensive":[156],"experiments":[157],"multiple":[159],"public":[160],"datasets":[162],"show":[163],"consistently":[166],"outperforms":[167],"state-of-the-art":[168],"baselines":[169],"in":[170],"multi-label":[172],"achieving":[174],"better":[175],"efficiency\u2013accuracy":[176],"trade-offs":[177],"strong":[179],"generalization":[180],"across":[181],"LLM":[182],"backbones.":[183],"Code":[184],"is":[185],"available":[186],"at":[187],"<uri":[188],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">https://anonymous.4open.science/r/APT9-RA-CTI</uri>.":[190]},"counts_by_year":[],"updated_date":"2026-06-07T06:13:29.825681","created_date":"2026-04-10T00:00:00"}