Planned intervention: On Wednesday June 26th 05:30 UTC Zenodo will be unavailable for 10-20 minutes to perform a storage cluster upgrade.
Published July 28, 2021 | Version v1
Conference paper Open

Named Entity Recognition in Cyber Threat Intelligence Using Transformer-based Models

Description

The continuous increase in sophistication of threat actors over the years has made the use of actionable threat intelligence a critical part of the defence against them. Such Cyber Threat Intelligence is published daily on several online sources, including vulnerability databases, CERT feeds, and social media, as well as on forums and web pages from the Surface and the Dark Web. Named Entity Recognition (NER) techniques can be used to extract the aforementioned information in an actionable form from such sources. In this paper we investigate how the latest advances in the NER domain, and in particular transformer-based models, can facilitate this process. To this end, the dataset for NER in Threat Intelligence (DNRTI) containing more than 300 pieces of threat intelligence reports from open source threat intelligence websites is used. Our experimental results demonstrate that transformer-based techniques are very effective in extracting cybersecurity-related named entities, by considerably outperforming the previous state- of-the-art approaches tested with DNRTI.

Notes

This is the accepted version of the paper. The final version of the paper can be found at https://ieeexplore.ieee.org/abstract/document/9527981

Files

2021_IEEE_ACTI_CSR_NER_in_CTI.pdf

Files (314.9 kB)

Name Size Download all
md5:b89851e7b5c3f91facf1bd8f694981b6
314.9 kB Preview Download

Additional details

Funding

FORESIGHT – Advanced cyber-security simulation platform for preparedness training in Aviation, Naval and Power-grid environments 833673
European Commission
ECHO – European network of Cybersecurity centres and competence Hub for innovation and Operations 830943
European Commission