Graph neural networks embedded with domain knowledge for cyber threat intelligence entity and relationship mining

Area of Science:

• Cybersecurity and Artificial Intelligence
• Natural Language Processing for Threat Intelligence

Background:

• Cyber-attacks are increasing in frequency and severity, posing significant challenges to cyberspace security.
• Named Entity Recognition (NER) aids in identifying threat entities and relationships within cyber threat intelligence.
• Existing NER models struggle with semantic representation, entity granularity, and relationship extraction accuracy.

Purpose of the Study:

• To propose a novel model, CtiErRe, for Network Threat Entity Recognition and Relationship Extraction.
• To redefine network threat entities and relationships for more precise cyber threat intelligence analysis.
• To address limitations in current models regarding semantic information, entity granularity, and relationship propagation errors.

Main Methods:

• Constructed a domain knowledge graph using collected domain knowledge.
• Embedded the knowledge graph using Graph Convolutional Networks (GCN) to enrich threat intelligence text features.
• Fused GCN embeddings with features from Bidirectional Encoder Representations from Transformers (BERT) using Layernorm.
• Utilized the GlobalPointer algorithm to generate threat entity and relationship matrices for identification.

Main Results:

• The proposed CtiErRe model demonstrated superior performance compared to existing models.
• Achieved 92.13% accuracy and 93.11% F1 score in threat entity recognition.
• Attained 91.45% accuracy and 92.45% F1 score in relationship extraction.

Conclusions:

• The CtiErRe model effectively enhances the identification of network threat entities and their relationships.
• The integration of domain knowledge graphs and advanced NLP techniques significantly improves cyber threat intelligence analysis.
• The model offers a robust solution for improving the efficiency and accuracy of cybersecurity defense and analysis.