Abstract:In recent years, as cybersecurity threats have become increasingly severe and cyberattacks have occurred frequently, higher requirements have been put forward for cybersecurity protection. Therefore, the Named Entity Recognition (NER) technique, which is the cornerstone of Cyber Threat Intelligence (CTI) analysis, is particularly important. However, most existing NER studies are limited to recognizing single-layer flat entities, ignoring the possible nested entities in CTI. On the other hand, most of the existing studies focus on English CTIs, and the existing models performed poorly in a limited number of Chinese CTI studies. Given the above challenges, we propose in this paper a novel unified model, RBTG, which aims to identify flat and nested entities in Chinese CTI effectively. To overcome the difficult boundary recognition problem and the direction-dependent and distance-dependent properties in Chinese CTI NER, we use Global Pointer as the decoder and TENER as the encoder layer, respectively. Specifically, the Global Pointer layer solves the problem of the insensitivity of general NER methods to entity boundaries by utilizing the relative position information and the multiplicative attention mechanism. The TENER layer adapts to the Chinese CTI NER task by introducing an attention mechanism with direction awareness and distance awareness. Meanwhile, to cope with the complex feature capture of hierarchical structure and dependencies among Chinese CTI nested entities, the TENER layer solves the problem by following the structure of multiple self-attention layers and feed-forward network layers superimposed on each other in the Transformer. In addition, to fill the gap in the Chinese CTI nested entity dataset, we further apply the Large Language Modeling (LLM) technique and domain knowledge to construct a high-quality Chinese CTI nested entity dataset, CDTinee, which consists of six entity types selected from STIX, including nearly 4000 entity types extracted from more than 3000 threatening sentences. In the experimental session, we conduct extensive experiments on multiple datasets, and the results show that the proposed model RBTG outperforms the baseline model in both flat NER and nested NER.

Named Entity Recognition in XLNet Cyberspace Security Domain Based on Dictionary Embedding

Named Entity Recognition by Using XLNet-BiLSTM-CRF

Data and knowledge-driven named entity recognition for cyber security

A Cybersecurity Named Entity Recognition Model Based on Active Learning and Self-learning

The Named Entity Recognition of Chinese Cybersecurity Using an Active Learning Strategy

SECURENET: Advancing Cybersecurity Knowledge Graphs with Multi-Feature Perceptrons and Hierarchical Adversarial W2NER

A network security entity recognition method based on feature template and CNN-BiLSTM-CRF

Chinese Named Entity Recognition Method for the Field of Network Security Based on RoBERTa

KGNER: Improving Chinese Named Entity Recognition by BERT Infused with the Knowledge Graph

LSTM Recurrent Neural Networks for Cybersecurity Named Entity Recognition

Multi-features based Semantic Augmentation Networks for Named Entity Recognition in Threat Intelligence

Text Command Intelligent Understanding for Cybersecurity Testing

Entity recognition model of power safety regulations knowledge graph based on BERT-BiLSTM-CRF

Semantic-enhanced graph neural network for named entity recognition in ancient Chinese books

A Unified Model for Chinese Cyber Threat Intelligence Flat Entity and Nested Entity Recognition

Hierarchical Contextualized Representation for Named Entity Recognition.

Named Entity Recognition with Bidirectional LSTM-CNNs

Using Domain Knowledge for Low Resource Named Entity Recognition

Referent graph embedding model for name entity recognition of Chinese car reviews

A Knowledge Graph Completion Algorithm Based on the Fusion of Neighborhood Features and vBiLSTM Encoding for Network Security

Named Entity Recognition Only from Word Embeddings