Hierarchical Retrieval Augmented Generation for Adversarial Technique Annotation in Cyber Threat Intelligence Text

This paper introduces H-TechniqueRAG, a novel hierarchical Retrieval-Augmented Generation (RAG) framework designed to improve the annotation of adversarial techniques in Cyber Threat Intelligence (CTI) text. It addresses the limitation of flat RAG approaches by incorporating the inherent tactic-technique taxonomy of the MITRE ATT&CK framework through a two-stage retrieval mechanism.