task_categories:

• text-classification
• sentence-similarity
• feature-extraction
  language:
• en
  tags:
• cybersecurity
• mitre-attack
• ttp
• cti
• threat-intelligence
• penetration-testing
• embeddings
• red-teaming
  pretty_name: MITRE ATT&CK TTP Mapping Dataset
  size_categories:
• 10K<n<100K
  license: cc-by-nc-sa-4.0

MITRE ATT&CK TTP Mapping Dataset

Training and evaluation data for mapping adversarial behavior descriptions (CTI reports,
CTF writeups, CISA advisories) to MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs).

Built as my individual contribution to a research project conducted at LORIA (supervised by Jean-Yves Marion). This dataset was developed and used to fine-tune skyylord/qwen3-emb-0.6b-ttp with CachedMultipleNegativesRankingLoss and ANCE-style hard negative re-mining.

Note: Due to their security nature, these datasets contain textual information about malware and other security aspects.

Dataset summary

Each example pairs a short instruction (a natural-language description of an
adversarial action — "the attacker used X to achieve Y") with the ground-truth
MITRE ATT&CK technique it corresponds to. The dataset is built for contrastive
retrieval training: given an instruction, retrieve the correct technique out of the
full ATT&CK Enterprise matrix (697 techniques/sub-techniques, v19).

Dataset Description

Expert, TRAM, Procedure, Derived Procedure

These four splits originate from tumeteor/Security-TTP-Mapping,
built for the NCE paper (see Citation). Summarized from their dataset card:

• TRAM: sourced from CTID's TRAM project,
  then deduplicated, cleaned of short/noisy text and noisy labels, and remapped to ATT&CK by tumeteor.
• Procedure: procedure examples pulled from MITRE's CTI repo,
  with markup stripped.
• Derived Procedure: built by crawling the reference URLs cited by each procedure example and
  extracting the passages relevant to that example.
• Expert: paragraphs drawn from a broader pool of threat reports and annotated by security
  practitioners; multi-label, with the test split averaging ~4 labels per example.

These splits were additionally remapped from the ATT&CK version tumeteor originally used
to ATT&CK v19 Enterprise, and re-split/re-processed to match the rest of this dataset's format. All credit for original collection,
cleaning, and the train/dev/test partitioning goes to tumeteor and the NCE paper authors.

Groups, Software, Campaigns

Collected and processed by me directly from MITRE ATT&CK's own Groups, Software, and Campaigns pages
(not a pre-existing dataset — MITRE publishes these as reference pages, not training-ready pairs).
In MITRE's own framing:

• Groups are adversary activity clusters tracked under a common name by the security community;
  each is mapped to its publicly-reported technique use, associated software, and campaigns.
• Software covers tools, malware, and utilities (commercial, open-source, or built-in) used to
  carry out adversary behavior, mapped to the techniques and groups they've been reported with.
• Campaigns are bounded-time intrusion activity sharing common targets/objectives, linked to the
  techniques, groups, and software involved where public reporting allows attribution.
  I converted these three pages into instruction/technique-label pairs for training.

CISA (held-out)

Scraped from published CISA cybersecurity advisories and processed into instruction/technique-label
pairs. Used exclusively as a held-out evaluation set — never trained on.

CTF writeups (held-out)

A mix of my own CTF writeups and public writeups from 0xdf, processed by
extracting the commands/actions used during each challenge and generating behavioral textual
descriptions from them via an LLM, then labeling the result with the corresponding ATT&CK technique.
The dataset contains only these derived behavioral descriptions, not the original writeup text.
Held out — never trained on.

Configs / subsets

Citation

If you use the expert, tram, procedure, or derived_procedure splits, please cite the
original NCE paper, whose data these are built from:

@inproceedings{nguyen-srndic-neth-ttpm,
    title     = "Noise Contrastive Estimation-based Matching Framework for Low-resource Security Attack Pattern Recognition",
    author    = "Nguyen, Tu and Srndic, Nedim and Neth, Alexander",
    booktitle = "Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics",
    month     = mar,
    year      = "2024",
    publisher = "Association for Computational Linguistics"
}

If you use this dataset as a whole (including the groups/software/campaigns/cisa/ctf_writeups
splits and the ATT&CK-v19 remapping):

@misc{mitre-attack-ttp-dataset,
  author       = {Amine Akhlafa},
  title        = {ATT&CK TTP Mapping Dataset},
  year         = {2026},
  publisher    = {Hugging Face},
  howpublished = {\url{https://huggingface.co/datasets/skyylord/mitre-attack-ttp-labeled-instructions}}
}

Related

• Model: skyylord/qwen3-emb-0.6b-ttp