A Named Entity Recognition Model for Threat Intelligence Based on Similar Semantic Space Construction

Extracting cybersecurity entities from unstructured web text is an important part of security analysis. Traditional BERT-based entity extraction models rely on a single semantic expression generated by the model, however, these models do not take into account the polysemous information that exists for entities in the intelligence domain, thus limiting the performance of traditional models for extracting entities. Therefore, this paper proposes a Semantic Enhancement Model (SEM) for named entities based on similar semantic space construction. First, the input text goes into BERT and CNN to get word-level word embeddings and character-level word embeddings respectively, and then merges them into mixed feature word embedding to enhance the robustness of the model. At the same time, SEM computes the set of similar words S-SET for the input text sequentially by the Similar Word Sense Matching Algorithm, and then uses the self-attention mechanism to compute the semantic relevance weights among the S-SET elements, so as to get the word embeddings with similar semantics. Subsequently mixed feature word embeddings and similar semantic word embeddings are used to calculate the similarity between the embedding vectors at different semantic levels through a multi-head attention mechanism, and then fused to construct an integrated semantic expression of the entity; thereby enriching the semantic expression of the entity and increasing the probability of the entity being predicted correctly. Finally, the integrated semantic expression is input into CRF for entity prediction. The experimental outcomes demonstrate that our proposed model outperforms existing baseline approaches on the network security datasets DNRTI and Bridge.