arXiv cs.CL· Hongyu She, Yiling He, Mengda Xie, Yiping Liu, Xingzhi Qian, Zhan Qin, Lorenzo Cavallaro·· 11 小时前AI 评分26
MEvince：用知识约束的 LLM 推理从恶意软件报告中识别 ATT&CK 技术
MEvince: Knowledge-Constrained LLM Reasoning for Technique Identification from Malware Reports
AI 导读
MEvince 是一个知识约束的 LLM 推理框架，用于报告级恶意软件 ATT&CK 技术识别，在 610 份 MITRE ATT&CK 引用的公开恶意软件报告上，其 exact-ID F1 比最强基线提升 17.4%。
正文 · 原文
Abstract:Mapping behavioral intelligence in malware analysis reports to ATT&CK techniques supports threat analysis and defense, but reliable identification remains challenging. Supporting evidence is often scattered across long, heterogeneous reports, while closely related techniques share behavioral cues and differ only in subtle but decisive details. While large language models (LLMs) can use external knowledge to interpret reports, they may assign techniques based on plausible associations rather than sufficient evidence. We present MEvince, a knowledge-constrained LLM reasoning framework for report-level malware technique identification. Its core is a shared behavioral representation connecting report observations to technique definitions. This representation is built through agentic mining of technique documentation and supports two online stages: 1) primitive-guided extraction uses behavioral primitives to structure LLM-extracted observations, link them to source passages, and group dispersed evidence; 2) evidence-aligned retrieval matches this evidence to technique profiles through the same concepts, retaining likely candidates and confusable alternatives for LLM comparison of distinguishing behaviors. Controls at both stages validate evidence references and check technique-specific requirements. The representation also supports adaptation without parameter updates, where offline agentic audits diagnose concept weaknesses and refine extraction or retrieval policies. We evaluate MEvince against 11 baselines spanning four method families using a dataset of 610 public malware reports referenced by MITRE ATT&CK. MEvince improves exact-ID F1 over the strongest baseline by 17.4%, and its concept-guided retrieval increases gold-label candidate coverage from 31.6% to 47.9%. With a small adaptation set, offline refinement yields further gains and outperforms baselines that update model parameters.
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL); Information Retrieval (cs.IR) |
| Cite as: | arXiv:2611.07486 [cs.CR] |
| (or arXiv:2611.07486v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2611.07486 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Yiling He [view email]
[v1]
Thu, 5 Nov 2026 05:45:20 UTC (476 KB)
来源：arXiv cs.CL · arxiv.org