Abstract:In recent years, as cybersecurity threats have become increasingly severe and cyberattacks have occurred frequently, higher requirements have been put forward for cybersecurity protection. Therefore, the Named Entity Recognition (NER) technique, which is the cornerstone of Cyber Threat Intelligence (CTI) analysis, is particularly important. However, most existing NER studies are limited to recognizing single-layer flat entities, ignoring the possible nested entities in CTI. On the other hand, most of the existing studies focus on English CTIs, and the existing models performed poorly in a limited number of Chinese CTI studies. Given the above challenges, we propose in this paper a novel unified model, RBTG, which aims to identify flat and nested entities in Chinese CTI effectively. To overcome the difficult boundary recognition problem and the direction-dependent and distance-dependent properties in Chinese CTI NER, we use Global Pointer as the decoder and TENER as the encoder layer, respectively. Specifically, the Global Pointer layer solves the problem of the insensitivity of general NER methods to entity boundaries by utilizing the relative position information and the multiplicative attention mechanism. The TENER layer adapts to the Chinese CTI NER task by introducing an attention mechanism with direction awareness and distance awareness. Meanwhile, to cope with the complex feature capture of hierarchical structure and dependencies among Chinese CTI nested entities, the TENER layer solves the problem by following the structure of multiple self-attention layers and feed-forward network layers superimposed on each other in the Transformer. In addition, to fill the gap in the Chinese CTI nested entity dataset, we further apply the Large Language Modeling (LLM) technique and domain knowledge to construct a high-quality Chinese CTI nested entity dataset, CDTinee, which consists of six entity types selected from STIX, including nearly 4000 entity types extracted from more than 3000 threatening sentences. In the experimental session, we conduct extensive experiments on multiple datasets, and the results show that the proposed model RBTG outperforms the baseline model in both flat NER and nested NER.

Finding Cycles in Graph: A Unified Approach for Various NER Tasks.

A Unified Generative Framework for Various NER Subtasks

Cycle Invariant Positional Encoding for Graph Representation Learning

Unified Named Entity Recognition as Word-Word Relation Classification

Cascaded Models for Better Fine-Grained Named Entity Recognition

Multi-task Transformer with Relation-attention and Type-attention for Named Entity Recognition

Joint Multimodal Entity-Relation Extraction Based on Edge-enhanced Graph Alignment Network and Word-pair Relation Tagging

KCB-FLAT: Enhancing Chinese Named Entity Recognition with Syntactic Information and Boundary Smoothing Techniques

Chinese named entity recognition: The state of the art

S-NER: A Concise and Efficient Span-Based Model for Named Entity Recognition

A Unified MRC Framework for Named Entity Recognition

CYCLE: Cross-Year Contrastive Learning in Entity-Linking

A simple but effective span-level tagging method for discontinuous named entity recognition

Parsing Named Entity As Syntactic Structure

RSRNeT: a novel multi-modal network framework for named entity recognition and relation extraction

Query-Based Named Entity Recognition

Named Entity Recognition via Machine Reading Comprehension: A Multi-Task Learning Approach

A Unified Model for Chinese Cyber Threat Intelligence Flat Entity and Nested Entity Recognition

Improving Coreference Resolution by Leveraging Entity-Centric Features with Graph Neural Networks and Second-order Inference

A novel pipelined end-to-end relation extraction framework with entity mentions and contextual semantic representation