Attack trees constitute a common and user-friendly method to guide the development of cybersecurity testing, but there is a lack of a generalized attack trees generation method currently to response to development of Advanced Persistent Threat (APT). Specifically, the performance is as follows: the attack tree generation is designed basically oriented to specific objects and situations and a lack of a universal attack trees generation method which is supposed to include standardized framework and the standardized language of cybersecurity industry. As a result, attack trees that do not fully utilize the cybersecurity knowledge base tend to be less universal and timely. Aiming at these problems, the paper proposes a self-evolution attack tree generation method for the Attack Techniques and Tactics (ATT&CK) recommendation based on the Multi-dimensional Data Association and Threat Analysis (MDATA) model. The method generates a continuously iterating and updating six-layer attack tree model in which the likelihood of occurrence and the extent of impact of each attack step are evaluated, recorded and updated by feedback from attack execution and recommendation of attack paths based on MDATA model. The results show that the method can enhance the versatility, timeliness and objectivity of the self-evolution attack tree model, which is valuable for the generation of attack trees in cybersecurity testing.