Joint Extraction of Cyber Threat Intelligence Entity Relationships Based on a Parallel Ensemble Prediction Model

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Natural Language Processing

Background:

• Knowledge graphs are crucial for cyber threat intelligence (CTI).
• Automated entity-relation extraction is key for CTI knowledge graph construction.
• Existing sequence tagging methods struggle with overlapping relations due to order-dependency.

Purpose of the Study:

• To propose a parallel, ensemble-prediction-based model for joint entity-relation extraction in CTI.
• To address the limitations of sequence tagging methods in handling overlapping relations.
• To reduce the cost and scarcity of labeled data in the CTI domain.

Main Methods:

• A joint network combining Bidirectional Encoder Representations from Transformers (BERT) and Bidirectional Gated Recurrent Unit (BiGRU) was developed.
• An ensemble prediction module and triad representation were designed for joint extraction.
• A non-autoregressive decoder was used for parallel generation of relation triad sets.
• The SecCti dataset was created using ChatGPT for labeling and augmentation to mitigate data scarcity.

Main Results:

• The proposed model achieved a 4.6% absolute F1 improvement over the baseline for joint entity-relation extraction.
• The parallel, non-autoregressive approach effectively handled overlapping relations.
• Leveraging ChatGPT for data augmentation significantly reduced annotation costs.

Conclusions:

• The parallel, ensemble-prediction model offers a more effective solution for joint entity-relation extraction in CTI.
• The approach successfully addresses the order-dependency problem and improves performance on overlapping relations.
• The data augmentation strategy using ChatGPT provides a cost-effective way to create labeled datasets for CTI.