Graph2TTP: Knowledge Graph-Guided Paragraph-Level TTPs Identification from Cyber Threat Intelligence Reports
: Mapping unstructured Cyber Threat Intelligence (CTI) reports to the MITRE ATT&CK framework is critical for proactive defence but remains a manual, time-consuming process. Existing automated approaches either rely on black-box language models that lack interpretable reasoning or brittle, rule-based knowledge graphs that fail to scale. To bridge this gap, we propose Graph2TTP, a novel neural-symbolic framework for automated, paragraph-level Tactic, Technique and Procedure (TTP) identification. Graph2TTP leverages the zero-shot comprehension of Large Language Models (LLMs) to automatically extract entities and relations from extensive CTI narratives, constructing rich, localized Cyber Security Knowledge Graphs (CSKGs). We encode these symbolic structures into dense embeddings and process them via a multi-label Edge-featured Graph Attention Network (EGAT). This hybrid architecture delivers both the high-fidelity accuracy of neural networks and the transparent, verifiable reasoning paths required by security analysts. To facilitate rigorous evaluation, we curate and release APTCTI, a real-world dataset comprising 690 Advanced Persistent Threat reports spanning over 18,087 paragraphs. Extensive evaluations across multiple datasets demonstrate that Graph2TTP outperforms state-of-the-art neural baselines (e.g., CySecBERT) by approximately 20% in F1 score, establishing a robust new standard for accurate and interpretable threat intelligence analysis.