Abstract:In recent years, as cybersecurity threats have become increasingly severe and cyberattacks have occurred frequently, higher requirements have been put forward for cybersecurity protection. Therefore, the Named Entity Recognition (NER) technique, which is the cornerstone of Cyber Threat Intelligence (CTI) analysis, is particularly important. However, most existing NER studies are limited to recognizing single-layer flat entities, ignoring the possible nested entities in CTI. On the other hand, most of the existing studies focus on English CTIs, and the existing models performed poorly in a limited number of Chinese CTI studies. Given the above challenges, we propose in this paper a novel unified model, RBTG, which aims to identify flat and nested entities in Chinese CTI effectively. To overcome the difficult boundary recognition problem and the direction-dependent and distance-dependent properties in Chinese CTI NER, we use Global Pointer as the decoder and TENER as the encoder layer, respectively. Specifically, the Global Pointer layer solves the problem of the insensitivity of general NER methods to entity boundaries by utilizing the relative position information and the multiplicative attention mechanism. The TENER layer adapts to the Chinese CTI NER task by introducing an attention mechanism with direction awareness and distance awareness. Meanwhile, to cope with the complex feature capture of hierarchical structure and dependencies among Chinese CTI nested entities, the TENER layer solves the problem by following the structure of multiple self-attention layers and feed-forward network layers superimposed on each other in the Transformer. In addition, to fill the gap in the Chinese CTI nested entity dataset, we further apply the Large Language Modeling (LLM) technique and domain knowledge to construct a high-quality Chinese CTI nested entity dataset, CDTinee, which consists of six entity types selected from STIX, including nearly 4000 entity types extracted from more than 3000 threatening sentences. In the experimental session, we conduct extensive experiments on multiple datasets, and the results show that the proposed model RBTG outperforms the baseline model in both flat NER and nested NER.

A network security entity recognition method based on feature template and CNN-BiLSTM-CRF

MTCNN and FACENET Based Access Control System for Face Detection and Recognition

CBF-IDS: Addressing Class Imbalance Using CNN-BiLSTM with Focal Loss in Network Intrusion Detection System

The Named Entity Recognition of Chinese Cybersecurity Using an Active Learning Strategy

Multi-features based Semantic Augmentation Networks for Named Entity Recognition in Threat Intelligence

Knowledge Graph Based Large Scale Network Security Threat Detection Techniques

Named Entity Recognition in XLNet Cyberspace Security Domain Based on Dictionary Embedding

Data and knowledge-driven named entity recognition for cyber security

KnowCTI: Knowledge-based Cyber threat intelligence entity and relation extraction

Entity Recognition of Chinese Electronic Medical Record Based on Gated Graph Neural Network

A Unified Model for Chinese Cyber Threat Intelligence Flat Entity and Nested Entity Recognition

BDBRC: A Chinese Military Entity Recognition Model Combining Context Contribution and Residual Dilatation Convolutional Networks

LSTM Recurrent Neural Networks for Cybersecurity Named Entity Recognition

Network Intrusion Detection Method Based on CNN-BiLSTM-Attention Model

Network Intrusion Detection Model Based on CNN and GRU

CANET: A hierarchical CNN-Attention model for Network Intrusion Detection

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

An Intrusion Detection System Based on GWO-CNN-BiLSTM

Predicting Entity Relations across Different Security Databases by Using Graph Attention Network

Research on phishing webpage detection technology based on CNN-BiLSTM algorithm

A Novel Threat Intelligence Information Extraction System Combining Multiple Models