Threat Intelligence Named Entity Recognition Based on Segment-Level Information Extraction and Similar Semantic Space Construction

Threat intelligence is crucial for the early detection of network security threats, and named entity recognition (NER) plays a critical role in this process. However, traditional NER models based on sequence tagging primarily focus on word-level information for single-token entities, which leads to the inefficient extraction of multi-token entities in intelligence texts. Moreover, traditional NER models provide only a single semantic representation of intelligence texts, meaning that polysemous entities in intelligence texts cannot be effectively classified. To address these problems, this paper proposes a novel model based on segment-level information extraction and similar semantic space construction (SSNER). First, SSNER retrains the traditional BERT model based on a threat intelligence corpus and modifies BERT’s mask mechanism to extract the segment-level word embedding so that the ability of the SSNER to recognize multi-token entities is enhanced. Second, SSNER designs a similar semantic space construction method, which obtains compound semantic representations with symmetrical properties by filtering out the set of similar words and integrating them using self-attention to generate more accurate labels for the polysemous entities. The experimental results on two datasets, DNRTI and Bridges, indicate that SSNER outperforms both baseline and related models. In particular, SSNER achieves an F1-score of 96.02% on the Bridges dataset, exceeding the previous best model by approximately 1.46%.