Abstract:Cyber threat intelligence (CTI) analysts routinely convert noisy, unstructured security artifacts into standardized, automation-ready representations. Although large language models (LLMs) show promise for this task, existing approaches remain brittle when producing structured CTI outputs and have largely relied on supervised fine-tuning (SFT). In contrast, CTI standards and community-maintained resources define canonical identifiers and schemas that enable deterministic verification of model outputs. We leverage this structure to study reinforcement learning with verifiable rewards (RLVR) for CTI tasks. We introduce Minerva, a unified dataset and training pipeline spanning multiple CTI subtasks, each paired with task-specific verifiers that score structured outputs and identifier predictions. To address reward sparsity during rollout, we propose MinervaRL, a lightweight self-training mechanism that generates additional verified trajectories and distills them back into the model. Averaged across four backbones and 12 CTI benchmarks, MinervaRL improves the mean score by 15.8 percentage points over the corresponding base models and by 4.3 points over GRPO.
| Subjects: | Machine Learning (cs.LG) |
| Cite as: | arXiv:2602.00513 [cs.LG] |
| (or arXiv:2602.00513v3 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2602.00513 arXiv-issued DOI via DataCite |
From: Md Tanvirul Alam [view email]
[v1]
Sat, 31 Jan 2026 05:01:01 UTC (179 KB)
[v2]
Wed, 11 Feb 2026 20:33:36 UTC (179 KB)
[v3]
Thu, 7 May 2026 22:52:51 UTC (236 KB)
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。