LLM-guided contrastive evidence mining for explainable cyber threat intelligence classification

Translating unstructured cyber threat intelligence (CTI) reports into the MITRE ATT&CK catalog is a cognitively demanding security operations task, and existing automated approaches face a trade-off between accuracy, faithful explanations, and coverage of rarely seen attack techniques. We present CSEM-CTI, a contextual self-adversarial evidence-mining framework built upon the self-adversarial tactic generation paradigm. The framework combines a domain-adapted SecureBERT encoder, LLM-guided prototype initialization using GPT-4o, a contrastive InfoNCE-based necessity loss, and a hierarchical tactic-conditioned focal classifier. Across three CTI corpora, CSEM-CTI reaches a tactic macro-F1 of 0.939 and a technique macro-F1 of 0.481, with rare-class macro-F1 rising from 0.083 to 0.363, ERASER comprehensiveness of 0.847 and sufficiency of 0.923, and a TextFooler attack success rate of 5.5%. The results indicate that representation quality, prototype geometry, and necessity loss formulation are coupled architectural choices that jointly determine accuracy, explanation faithfulness, and robustness, supporting deployment of auditable TTP classification in security workflows.