@article{Mohammed2026, 
author = {Dilkhaz Mohammed and Shahram Jamali},
title = {Evo-TTP: Generative and robust prediction of novel cyber threat tactics using adversarial fine-tuning of large language models},
year = {2026},
journal = {AIMS Electronics and Electrical Engineering},
volume = {10},
number = {2},
pages = {314-333},
keywords = {large language models (LLMs), cybersecurity, MITRE ATT&CK v18.0, adversarial fine-tuning, group relative policy optimization (GRPO), big data mining, predictive threat intelligence, hidden pattern discovery},
url = {https://www.sciopen.com/article/10.3934/electreng.2026013},
doi = {10.3934/electreng.2026013},
abstract = {The asymmetrical nature of the modern cyber threat landscape allows advanced persistent threats (APTs) to innovate tactics at a significantly faster rate than defensive frameworks can document them. While the MITRE ATT & CK® framework provides a standardized taxonomy of known behaviors, it essentially functions as a retrospective database — a "dictionary of the past" which fails to anticipate future "zero-day" tactics, techniques, and procedures (TTPs). This paper introduces Evo-TTP, a comprehensive framework for the predictive generation of novel and robust tactics, techniques, and procedures via big data mining and adversarial learning. By leveraging the massive structured data from the MITRE ATT & CK® Enterprise Matrix v18.0, Evo-TTP treats the prediction of future threats as a high-dimensional pattern completion problem. Our methodology addresses two primary failures in current generative AI applications to big data: mode collapse, which refers to hallucinating biologically or technically impossible scenarios, and algorithmic brittleness, which is characterized by its susceptibility to adversarial perturbations. We employ a tripartite approach: (1) applying semantic pattern mining on the v18.0 dataset to create a baseline knowledge graph that reveals hidden correlations; (2) utilizing synthetic novelty expansion with a teacher-student architecture, using Llama-3.1-405B as the teacher and Llama-3.1-8B as the student model, to overcome data scarcity; and (3) conducting training in adversarial group relative policy optimization (GRPO). This training regime maximizes a composite reward function by balancing novelty, technical feasibility, and resilience against adversarial noise. Validated against the 2025 benchmarks and vetted according to SafeGen-X principles, Evo-TTP demonstrates a 23.1% increase in utility and an 18.2% improvement in robustness to adversarial attacks when compared with standard fine-tuning methods. This research positions generative AI not only as a text processor but also as a critical instrument in big data for uncovering the hidden evolutionary mechanics of cyberwarfare.}
}