DART: Data Augmentation of Rare ATT&CK Techniques Using LLM Agents
Publication Date
1-1-2026
Document Type
Conference Proceeding
Publication Title
Proceedings 47th IEEE Symposium on Security and Privacy Workshops Spw 2026
DOI
10.1109/SPW72489.2026.00044
First Page
351
Last Page
360
Abstract
Machine learning for cybersecurity relies on representative datasets, yet most security datasets remain highly imbalanced across classes. This problem is particularly acute for datasets mapped to the MITRE ATT&CK framework, where well-documented adversarial behaviors dominate while rare or complex techniques are underrepresented, creating blind spots for detection systems. We present DART, a semi-automated system for generating ATT&CK-grounded malicious commandline samples. DART combines Python-based orchestration, syntax validation through parsers and compilers, large language models (LLMs) for constrained command generation and multi-agent evaluation, and embedding-based cosine similarity to measure dataset diversity. Our four-phase pipeline defines generation scenarios, produces candidate commands through constrained prompting, validates their syntactic and semantic quality via static testing and multi-agent scoring, and applies diversity filtering to curate a balanced and representative dataset. Results demonstrate that the system generates operationally realistic and diverse samples while providing a scalable framework for improving coverage of underrepresented ATT&CK techniques.
Keywords
CLI, Data Augmentation, LLM, MITRE ATT&CK
Department
Computer Engineering
Recommended Citation
Taya Ambrose, Sergio Valderrama, Younghee Park, and Alvaro A. Cardenas. "DART: Data Augmentation of Rare ATT&CK Techniques Using LLM Agents" Proceedings 47th IEEE Symposium on Security and Privacy Workshops Spw 2026 (2026): 351-360. https://doi.org/10.1109/SPW72489.2026.00044
