CyberEntRel: Research Paper, Dataset and Code

The cyber threat intelligence (CTI) knowledge graph is beneficial for making robust defense strategies for security professionals. These are built from cyber threat intelligence data based on relation triples where each relation triple contains two entities associated with one relation. The main problem is that the CTI data is increasing more rapidly than expected and existing techniques are becoming ineffective for extracting the CTI information. This work mainly focuses on the extraction of cyber relation triples in an effective way using the joint extraction technique, which resolves the issues in the classical pipeline technique. Firstly, the ‘BIEOS’ tagging scheme was applied to CTI data using the joint tagging technique and then the relation triples were jointly extracted. This study utilized the attention-based RoBERTa-BiGRU-CRF model for sequential tagging. Finally, the relation triples were extracted using the relation-matching technique after matching the best suitable relation for the two predicted entities. The experimental results showed that this technique outperformed the state-of-the-art models in knowledge triple extraction on CTI data. Furthermore, a 7% increase in the F1 score also proved the effectiveness of this technique for the information extraction task on CTI data.

网络威胁情报（Cyber Threat Intelligence，CTI）知识图谱有助于安全专业人员制定稳健的防御策略。此类图谱基于关系三元组构建，其数据来源于网络威胁情报；每个关系三元组包含两个实体及二者间的关联关系。核心问题在于，CTI数据的增长速度远超预期，现有技术在提取CTI信息方面已逐渐失效。本研究聚焦于采用联合提取技术（joint extraction technique）高效提取网络关系三元组，该技术可解决传统流水线技术存在的问题。首先，采用联合标注技术（joint tagging technique）将‘BIEOS’标注方案应用于CTI数据，随后联合提取关系三元组。本研究采用基于注意力机制的（attention-based）RoBERTa-BiGRU-CRF模型进行序列标注。最后，在为预测的两个实体匹配最合适的关系后，采用关系匹配技术（relation-matching technique）提取关系三元组。实验结果表明，该技术在CTI数据的知识三元组提取任务中性能优于最先进的（state-of-the-art）模型。此外，F1分数提升7%，进一步证明了该技术在CTI数据信息提取任务中的有效性。