Grid-tagging-based Chinese threat intelligence entity recognition technology

With the development of automated attack technologies, an increasing number of advanced attacks emerged. Cyber threat intelligence knowledge graphs constructed based on these attack information can effectively identify the characteristics of network attack behaviors, aiding in the detection of sophisticated attacks. However, the cyber threat intelligence collected from diverse sources and has the characteristics of unstructured data. In particular, Chinese cyber threat intelligence, due to its linguistic intricacies, presents significant challenges for automated entity recognition technologies. In this paper, we propose a chinese cyber threat intelligence entity recognition method which can effectively identify nested and discontinuous entities. Furthermore, we added a joint prediction layer to determine the boundaries of professional terminology in the field of network security, enabling more accurate identification of cyber threat intelligence entities. Experiments conducted on two datasets-CDTier datasets and CTIreport collected from open-source sites shows that our model achieves an improvement of 1.2-2.3% in F1 score compared to the state-of-the-art method.