A Knowledge-Enhanced Cyber Threat Intelligence Entity and Relation Extraction Method

Extracting entities and the relations between entities from cybersecurity-related text is a key step in the application of cyber threat intelligence to security defense. The existing methods for entity and relation extraction suffer from the issue of insufficient semantic understanding in the process of cyber threat intelligence extraction. To address the problem, a knowledge-enhanced cyber threat intelligence entity and relation extraction method is proposed. Specifically, cybersecurity-related texts and external cybersecurity knowledge are first collected to form a dataset and external knowledge base for training and validating the extraction method. Then, external cybersecurity knowledge is inserted and fused into the text sentences. The external cybersecurity knowledge can explain the key information in the text, thereby enhancing the semantic representation model's understanding of the semantic information in the text. Finally, entity-relation triples of cyber threat intelligence are extracted by a relation-guided attention network, and the entity-relation triples are used to strengthen cybersecurity defense capabilities. Experimental results demonstrate that the proposed method for cyber threat intelligence entity and relation extraction achieves precision, recall, and F1 score of 0.926, 0.950, and 0.938, respectively, outperforming other entity and relation extraction methods such as STIXnet and CyberEntRel.