Towards Efficient Threat Intelligence Instruction Tuning via Quality-Aware and Optimal Transport-Guided Data Selection

Abstract

High-quality data is essential for improving instruction tuning in threat intelligence analysis. However, existing methods for generating cybersecurity instruction data lack reliable quality assessment mechanisms, and gradient influence-based data selection methods primarily focus on single-sample matching, failing to cover diverse and complex security capabilities. To address these issues, we propose CTI-TDS, a Targeted Data Selection method for instruction tuning in Cyber Threat Intelligence analysis. Specifically, we first filter high-quality CTI instructions by integrating instruction style consistency and security knowledge verification. Furthermore, we formulate gradient influence as a distribution alignment problem, learning a gradient subspace of target tasks and applying entropic regularized optimal transport to optimize distribution matching between training samples and target tasks, enabling diversity-aware data selection. We conduct extensive experiments on CTIBench across multiple large language models. Experimental results demonstrate that when fine-tuning with only a small set of high-value instruction data, CTI-TDS outperforms existing data selection methods and achieves competitive performance on threat intelligence analysis tasks.