Cyber Threat Intelligence Entity Extraction Based on Deep Learning and Field Knowledge Engineering

The typical domain characteristics of Cyber Threat Intelligence (CTI), such as fuzzy entity boundary, polysemy or a single word corresponding to multiple word expressions and so on, makes the entity recognition result be worse than we expected. In addition, there are many challenges in directly migrating entity recognition models from the general field to CTI field. Therefore, we propose a deep learning entity recognition model with supplementing the domain knowledge engineering, which takes the open-source Cyber Threat Intelligence entity recognition as the research object, covering natural language processing, deep learning and cyber threat intelligence fields. Firstly, we use BERT model to obtain the dynamic word vector, then encode the word sequence by using BiLSTM-CRF, and finally improve the recognition result by using knowledge engineering of the Cyber Threat Intelligence to help increase the accuracy of entity recognition. Besides, we verify the effectiveness of the proposed model by experiments.