網路威脅情資（CTI）報告是理解攻擊者行為的主要來源，將其對應至 MITRE ATT&CK 等結構化知識庫是 CTI 分析的核心工作。實務上，報告語句常被編碼為 dense embedding，但這些表徵同時糾纏了技術行為、戰術意圖與來源風格等異質因素，在低標註情境下限制了樣本效率。
本研究提出一個知識引導的雙路條件式自編碼器（Dual-path Conditional Autoencoder ），以 ATT&CK 描述作為弱監督，將報告 embedding 解耦為技術、戰術與殘差三個具明確語意角色的成分，並以階層方式套用兩階段分解。本研究系統性地分析 condition 的建構（RQ2）與注入（RQ3）對解耦品質的影響。
在維度控制的公平比較下，主技術因子於低標註區間優於維度對齊基準，展現更佳的樣本效率；來源相關結構被成功導向殘差，且整體準確率不受損；各成分亦呈現可解釋、可遷移的「如何執行（how）–為何執行（why）」語意分工。

Cyber threat intelligence (CTI) reports are a primary source for understanding adversary behavior, and mapping them onto structured knowledge bases such as MITRE ATT&CK is a central task in CTI analysis. In practice, report sentences are encoded into dense embeddings, but these embeddings entangle heterogeneous factors, including technique-level behavior, tactic-level intent, and source-specific writing style, within a single undifferentiated vector, which limits sample efficiency under low-label conditions.
This study proposes a knowledge-guided, dual-path Conditional Autoencoder (CAE) that uses ATT&CK descriptions as weak supervision to disentangle a report embedding into three components with well-defined semantic roles, namely technique, tactic, and residual, applying the same decomposition mechanism twice in a hierarchical manner. The thesis systematically studies how condition construction (RQ2) and injection (RQ3) affect disentanglement quality, selecting the configuration with the cleanest disentanglement through a two-stage validation-set sweep.
Under a dimension-controlled fair comparison, the primary technique factor outperforms the dimension-aligned baseline in the low-label region, exhibiting better few-shot sample efficiency; source-related structure is successfully routed into the residual without harming overall accuracy; and attention analysis, word-space probing, and controlled T5 substitution jointly show that the components carry interpretable, transferable “how–why” semantic roles, further verified on an external threat report.

Dittadi, A., Träuble, F., Locatello, F., Wüthrich, M., Aber, V., Winther, O., Schölkopf, B., & Bauer, S. (2021). On the transfer of disentangled representations in realistic settings. Proceedings of the International Conference on Learning Representations (ICLR).
Eastwood, C., & Williams, C. K. I. (2018). A framework for the quantitative evaluation of disentangled representations. Proceedings of the International Conference on Learning Representations (ICLR).
Gretton, A., Bousquet, O., Smola, A., & Schölkopf, B. (2005). Measuring statistical dependence with Hilbert-Schmidt norms. Proceedings of the International Conference on Algorithmic Learning Theory (ALT), 63–77.
Higgins, I., Matthey, L., Pal, A., Burgess, C., Glorot, X., Botvinick, M., Mohamed, S., & Lerchner, A. (2017). β-VAE: Learning basic visual concepts with a constrained variational framework. Proceedings of the International Conference on Learning Representations (ICLR).
Husari, G., Al-Shaer, E., Ahmed, M., Chu, B., & Niu, X. (2017). TTPDrill: Automatic and accurate extraction of threat actions from unstructured text of CTI sources. Proceedings of the 33rd Annual Computer Security Applications Conference (ACSAC), 103–115.
Kim, H., & Mnih, A. (2018). Disentangling by factorising. Proceedings of the International Conference on Machine Learning (ICML), 2649–2658.
Legoy, V., Caselli, M., Seifert, C., & Peter, A. (2020). Automated retrieval of ATT&CK tactics and techniques for cyber threat reports. arXiv preprint arXiv:2004.14322.
Li, Z., Zeng, J., Chen, Y., & Liang, Z. (2022). AttacKG: Constructing technique knowledge graph from cyber threat intelligence reports. Proceedings of the European Symposium on Research in Computer Security (ESORICS), 589–609.
Locatello, F., Bauer, S., Lucic, M., Rätsch, G., Gelly, S., Schölkopf, B., & Bachem, O. (2019). Challenging common assumptions in the unsupervised learning of disentangled representations. Proceedings of the International Conference on Machine Learning (ICML), 4114–4124.
MITRE. (2020). Threat Report ATT&CK Mapping (TRAM). Retrieved from https://github.com/center-for-threat-informed-defense/tram
Montero, M. L., Ludwig, C. J. H., Costa, R. P., Malhotra, G., & Bowers, J. (2022). Lost in latent space: Disentangled models and the challenge of combinatorial generalisation. Proceedings of the International Conference on Learning Representations (ICLR).
Perez, E., Strub, F., de Vries, H., Dumoulin, V., & Courville, A. (2018). FiLM: Visual reasoning with a general conditioning layer. Proceedings of the AAAI Conference on Artificial Intelligence, 3942–3951.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., & Ommer, B. (2022). High-resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 10684–10695.
Sohn, K., Lee, H., & Yan, X. (2015). Learning structured output representation using deep conditional generative models. Advances in Neural Information Processing Systems (NeurIPS), 28.
Strom, B. E., Applebaum, A., Miller, D. P., Nickels, K. C., Pennington, A. G., & Thomas, C. B. (2018). MITRE ATT&CK: Design and philosophy. MITRE Technical Report.
Ting, Y.-S., Rix, H.-W., Contursi, G., Ho, A. Y. Q., & Frankel, N. (2022). Disentangling the Milky Way with a label-free conditional autoencoder. The Astrophysical Journal, 926(2), 189.
van Steenkiste, S., Locatello, F., Schmidhuber, J., & Bachem, O. (2019). Are disentangled representations helpful for abstract visual reasoning? Advances in Neural Information Processing Systems (NeurIPS), 32.
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, Ł., & Polosukhin, I. (2017). Attention is all you need. Advances in Neural Information Processing Systems (NeurIPS), 30.
You, Y., Yao, J., Liu, J., Wang, B., & Jiang, J. (2022). CyberEntRel: Joint extraction of cyber entities and relations using deep learning. Computers & Security, 113, 102537.