We introduces Crimson, a system that enhances the strategic reasoning capabilities of Large Language Models (LLMs) within the realm of cybersecurity. By correlating CVEs with MITRE ATT&CK techniques, Crimson advances threat anticipation and strategic defense efforts. Our approach includes defining and evaluating cybersecurity strategic tasks, alongside implementing a comprehensive human-in-the-loop data-synthetic workflow to develop the CVE-to-ATT&CK Mapping (CVEM) dataset. We further enhance LLMs' reasoning abilities through a novel Retrieval-Aware Training (RAT) process and its refined iteration, RAT-R. Our findings demonstrate that an LLM fine-tuned with our techniques, possessing 7 billion parameters, approaches the performance level of GPT-4, showing markedly lower rates of hallucination and errors, and surpassing other models in strategic reasoning tasks. Moreover, domain-specific fine-tuning of embedding models significantly improves performance within cybersecurity contexts, underscoring the efficacy of our methodology. By leveraging Crimson to convert raw vulnerability data into structured and actionable insights, we bolster proactive cybersecurity defenses.

通过将CVE与MITRE ATT＆CK技术相关联，Crimson增强了大型语言模型（LLMs）在网络安全领域的战略推理能力，通过定义和评估网络安全战略任务，利用人为参与的数据合成工作流程开发了CVE-to- ATT＆CK Mapping（CVEM）数据集，并通过一种新颖的Retrieval-Aware Training（RAT）过程和其改进版本RAT-R进一步增强了LLMs的推理能力。研究结果表明， 经过我们的技术微调的具有70亿参数的LLM接近GPT-4的性能水平，在战略推理任务中显示出明显更低的幻觉和错误率，并超越其他模型。此外，特定领域的嵌入模型微调显著提高了网络安全环境中的性能，凸显了我们方法的有效性。通过利用Crimson将原始漏洞数据转化为结构化和可行动的见解，我们加强了积极的网络安全防御。

Crimson: 通过大型语言模型增强网络安全中的战略推理能力