Cyberattack event and arguments extraction based on feature interaction and few-shot learning.

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Data Science

Background:

• Cyber Threat Intelligence (CTI) is vital for analyzing cyberattacks and vulnerabilities.
• Current deep learning methods struggle with CTI's complexity and data scarcity.
• Lack of large annotated corpora hinders direct application of large language models (LLMs).

Purpose of the Study:

• To enhance the efficiency of CTI information extraction.
• To address the challenges of complexity and data scarcity in CTI data.
• To improve the performance of cybersecurity event extraction methods.

Main Methods:

• Proposed the Cyber Attack Feature Interaction Information Extraction (CAFIIE) method.
• Implemented multi-layer shallow feature interactions to capture latent threat entity characteristics.
• Fine-tuned the CAFIIE model using few-shot learning for data-limited scenarios.

Main Results:

• CAFIIE effectively captures latent deep features in CTI threat entity interactions.
• The method demonstrates superior accuracy and F1-score performance.
• CAFIIE shows improved CTI feature utilization efficiency.

Conclusions:

• The CAFIIE method offers a significant advancement in CTI information extraction.
• Few-shot learning makes CAFIIE suitable for data-limited cybersecurity environments.
• CAFIIE outperforms existing baseline methods on multiple datasets.