MEvince preprint reports improved identification of malware techniques

Researchers report that MEvince, a framework for identifying attack techniques in malware reports, improves exact-ID F1 over the strongest of 11 baselines by 17.4%. The preprint evaluates the system on 610 public malware reports referenced by MITRE ATT&CK. MEvince links observations to source passages and technique definitions, then compares potentially confusable techniques using their distinguishing behaviors. Its retrieval method increases coverage of correct technique candidates from 31.6% to 47.9%. Offline audits refine extraction and retrieval policies without updating model parameters. The reported gains come from evaluation on that report dataset.